Port VLAN is very simple, all it do is to block the communication between different port VLAN. So if you don't want the client from different AP to communicate with each other, just connect these two AP to two port that belong to different Port VLAN. If you use a single AP with multiple SSID, since it can only connected to one port, so there is not able to use port vlan to do the seperate work. generally, multi SSID based on 802.1Q Tag VLAN, it's another more complicated VLAN tech.

istvank,

Your post is pretty old, but civic is correct.

Basically you need two Access Points to accomplish this. But your guest network on one VLAN and your secure (private) network on a different VLAN.

This is how we have configured it and it works great (and the APs are not that expensive).

Hope this helps.