How exactly is he connecting to the speakers? Through the Sonos app, AirPlay, or a third-party app like Spotify?

Not per se, no. The Sonos system is, generally speaking, connected to the wifi itself. 

That being said, making changes to the Sonos system (adding new channels, etc) is protected by a password, so you could have it so he couldn’t connect to make those type of changes. But playing music he’d still have access to. 

If you have someone you don’t want, but can’t avoid, on your local wifi, your best bet is to set up a travel router with a different SSID, and don’t give him the password. The travel router would connect to your regular wifi, and you would set all the Sonos devices and your controller devices to connect to the travel router’s SSID, thus blocking your brother. 

Thanks for your reply, it's really a struggle because with bluethooth devices i dont have this problem, so it's a little disapointing that sonos didn't add a connect only for my phone or something, that would be the perfect option because i dont like that people random connect to my devices.

I think the general assumption is that if they have access to your wifi, they’re already an approved user of the system. 

Not ideal for you, I’d agree, but probably satisfies 95% of their customer base. 

So it's ideal to have a router with WISP? i gues that's the best option.

No, I wouldn’t expect so. I’d stick with my original suggestion of a travel router, not a WISP router. You want to have your own network, that uses the “public” network that you already have for a connection. If you went WISP, wouldn’t your brother have access to that as well? 

Why not set up a guest network for your guests? Most routers can do this.