How to divide the organization's network into private and guest (netmap under the cut)?

Question

D-Link

There is a network that you see in the image (done in haste).
Task:
Having what we have, create a guest Wi-fi access point, while not allowing clients to see the organization's local network from this point. Internet channel one. Do not offer iota).
My options:
Instead of dir140, stick dir-300 (dd-wrt). For me, this is the only option, BUT ...
- I never set up vlan, etc. things and I don’t know how it is in dd-vrt (because in off-firmware the length is somehow more or less clear
- I’m not sure that the router’s percentage will pull ~ 30 clients + vpn
Your suggestions?

Answer 1

pppoe to the gateway. and let all clients of the wafer through the gateway only to the Internet. much easier. and you can get by with any router

Answer 2

I have one Internet channel at work, and 5 real IP addresses (there were options to purchase 4 or 8 addresses, while 3 addresses are used by the provider for technological purposes, but I needed 2 at least ...).
One allocated for guests - a switch and a router. Guest WiFi is not connected to the enterprise network in any way.

Answer 3

I would still stick it in the center:
http://mikrotik.rf/katalog/kommutatory/crs125_24g_...
or
http://mikrotik.rf/katalog/kommutatory/crs125_24g_...
instead of half of the pieces of iron ...... ....