Atheros. There's simply no other chipset with as good functionality; and I also use my cardbus atheros wlan adapter only for an access point for my DS
You could leave it always on, by only allowing your DS's MAC address. Also do cap it to 802.11b (max 11Mbps), because the DS can't do any better. Maybe also restrict the range. This along with WEP should keep everyone away as long as they don't want to bother hard with your connection.
The Atheros devices can be used as both a host and a device, at least most of them can; my card supports two virtual points, and one can be a client while one is an AP