For a pure guest network, e.g. hotel guests that only should be able to reach the Internet individually, I like to route them locally. In other words a conventional router with NAT at each AP site. They get their IP from a DHCP server in that router. The "WAN" side dumps into a LAN, which can be backhauled by any sort of connection even an ordinary non-WDS STA-AP link.
Firewall rules can then be added to the guest AP to prevent the guests from accessing any part of your private system. They only have the Internet.