Don't need dual radios for that. I operate 4 different (hidden) SSIDs using a single radio in my router. Different SSIDs for different purposes, with different authentication, encryption and firewall rules.
One of those SSIDs is for guest use. I simply disable it when not in use. Its a very quick and simple task to enable it when I have a guest that requires internet access - and the internet is all it can access.
Different radios or different SSID's don't do any good regarding the OP's concerns if they're all behind the same firewall, no?