Guest network - vlan no internet access

[CGGXANNX]

I think that you don’t need VLANs at all, if your main goal is to have segregated wifi for guests, you just need firewall rule that will drop traffic between those networks. And even with VLANs you will have to separate them with firewall rule.

VLAN should still be used, because I am certain that OP would like for the devices to be separated at Layer 2 too. Otherwise, the rogue guests would still be able to sniff traffic, snoop ARP, setup fake DHCP server, etc…