Hi,
It comes very close to it. ...
OK - my next idea would be to use use a wifi router as your internet gateway *outside* the SME server, with the router's wifi configured for guest users.
Or, use a router instead of an access point for guests, set the WAN IP on the router to a fixed IP on your SME LAN, then create custom settings to deny access from that IP to anything on the SME server, and (if possible) rules on the router to deny access to anything on the WAN subnet except the SME server.