How to protect WI-FI with access to a corporate network?

Question

Computer networks

Good morning.
There is an ASUS RT-N66U with the ability to create guest networks and a corporate network.
It is necessary to include ASUS in the corporate network and make the guest network only with Internet access.
It is planned to restrict traffic with a firewall, hide the network and whitelist the MAC addresses of devices that need access to the corporate network.
Hence the question: by what means can you encrypt traffic (that is, protect yourself from traffic interception)? VPN?

Answer 1

What for?? Make two networks! One guest with a regular password, the second with access to the network. Password + domain authorization through captive portal
There are a lot of points that can hold several networks at once.

Answer 2

VLAN, right?