It depends a bit on the end users. If this is a guest account with temporary users, I would recommend PSK with a Guest-Internet-Access-Only IP firewall set up on the AP. If these are known users who just happen to bring their own device or devices, I would suggest a PPSK SSID, so all users have their own username and password, and you can either allow them to use this on an unlimited number of devices or on a restricted number of devices.
Radius is best suited to known clients with static, known devices. Additionally, the management overhead for constantly adjusting for new passwords as you are currently running in to. Also there is the problem with certificates. Where you are using the default certificates or third party certificates, unless you manually install the certificate in use on each new device, they will get warning messages about navigating to untrusted sources, which will slow them down and may alarm some users. Radius is a stateless authentication process, meaning that after the initial login, it does not keep track of users permissions to be on the network. Typically for guest networks admins prefer SSID types that keep track of client state, such as PPSK.
