You design two network topologies, one private (let's call it LAN) and one for guests (called GUEST). You need either a router capable of creating two networks (LAN, GUEST) in addition to the WAN (Internet) or two routers (one for LAN, one for GUEST) and a managed switch.

You then create two SSIDs, one for LAN users, one for GUESTs. Assign the LAN SSID a VLAN ID and the GUEST SSID another VLAN ID so you can separate traffic coming over the same physical cable in your router (or switch). Then either connect the AP directly to the router (if it supports VLANs) and assign the two networks those VLAN IDs or use a managed switch in-between to split the VLAN into two connections to the router. Using a Linux-based router, this is pretty easy, you even don't need a managed switch.