Thanks John,
I put here a synthesis regarding my question and its developments:
I have never considered the "hide my Wi-Fi SSID" option, because it is:
1) useless for the security of my network and against potential attackers. The SSID can still be discovered.
2) it is not useful even for "aesthetic" reasons ( :-) ?), because I should hide others, not my network ... in this sense it would be enough to have a whitelist for the good guys or even better have at least a blacklist where only malicious guests are filtered.
I have direct evidence that someone entered my poor network a few weeks ago and probably got bored for a while ... nevertheless I would not want to give them access so easily. I have extremely restrictive policies, really strong passwords, solid encryption algorithms and they managed to get through. Maybe for a high school experiment ( ?? LoL ) …
So considering all these points together, seeing this situation as a theoretical network design problem, I would simply eliminate all possible IDs around the wifi (and the same should be for the phone ...) and live in peace.
Assuming that I can't do this ...
for the security part, the best option will be to hardwire with cables all the important and high-bandwidth devices, assigning priorities, isolating IoT devices in one or more NAT subnets and so on.
for the "aesthetic view" outside, I would prefer not to see who is out there on the web and as you all indicated, there is little to do at the moment on MAC devices.
On Windows I can visually filter the external SSIDs with the netsh command and its switches and I can solve the "aesthetic" problem and also the network browsing problem, but even on Windows I do not solve the security problem.
Needless to say, things get worse with the cell phones where (always from a theoretical point of view), the possibility of access increases because we always carry it around and the number of nets is multiplied exponentially.
I still think it would be a really cool feature to block all external SSIDs and external nets regardless, and then through an admin console on the phone or the router, allow trusted devices to access it (for friends, colleagues, trusted services, etc.).
They don't seem to think so... anyway hope someone will find this thread helpful. I have clearer thoughts on all this stuff now.
Thanks and Best Regards,
P.