Apple Time Capsule Custom Firmware =link= -

Install WireGuard ( opkg install wireguard-tools ). Configure it as a client to a commercial VPN (like Mullvad or ProtonVPN). Then, set up policy-based routing so that only your Apple TV or specific IPs go through the VPN. Your Mac still gets local access for printing.