I think you are looking at this incorrectly.
Typically, you would have multiple SSIDs, including one for guests. The VLAN for the guest SSID would only be allowed to be routed to the Internet, while other SSIDs would be on networks which have various internal access restrictions, or not.
Often, 802.1X is used for such authentication, but there are other authentication methods, and Cisco WLCs support several (see Authentication on Wireless LAN Controllers Configuration Examples). A guest would only be able to be authenticated on the guest SSID since the guest credentials will not exist for the other SSIDs.
Authentication on WLCs
The Cisco Unified Wireless Network (UWN) security solution bundles
potentially complicated Layer 1, Layer 2, and Layer 3 802.11 Access
Point (AP) security components into a simple policy manager that
customizes system-wide security policies on a per-wireless LAN (WLAN)
basis. The Cisco UWN security solution provides simple, unified, and
systematic security management tools.
These security mechanisms can be implemented on WLCs.
Layer 1 Solutions
Restrict client access based on the number of consecutive failed
attempts.
Layer 2 Solutions
None Authentication —When this option is selected from the Layer 2 Security drop-down list, No Layer 2 authentication is performed on the
WLAN. This is the same as the open authentication of the 802.11
standard.
Static WEP —With Static Wired Equivalent Privacy (WEP), all APs and client radio NICs on a particular WLAN must use the same
encryption key. Each sending station encrypts the body of each frame
with a WEP key before transmission, and the receiving station decrypts
it using an identical key upon reception.
802.1x —Configures the WLAN to use the 802.1x based authentication. The use of IEEE 802.1X offers an effective framework
in order to authenticate and control user traffic to a protected
network, as well as dynamically vary encryption keys. 802.1X ties a
protocol called Extensible Authentication Protocol (EAP) to both the
wired and WLAN media and supports multiple authentication methods.
Static WEP + 802.1x —This Layer 2 security setting enables both 802.1x and Static WEP. Clients can either use Static WEP or 802.1x authentication in order to connect to the network.
Wi-Fi Protected Access (WPA) —WPA or WPA1 and WPA2 are standard-based security solutions from the Wi-Fi Alliance that provide
data protection and access control for WLAN systems. WPA1 is
compatible with the IEEE 802.11i standard but was implemented before
the standard's ratification. WPA2 is the Wi-Fi Alliance's
implementation of the ratified IEEE 802.11i standard.
By default, WPA1 uses Temporal Key Integrity Protocol (TKIP) and
message integrity check (MIC) for data protection. WPA2 uses the
stronger Advanced Encryption Standard encryption algorithm using
Counter Mode with Cipher Block Chaining Message Authentication Code
Protocol (AES-CCMP). Both WPA1 and WPA2 use 802.1X for authenticated
key management by default. However, these options are also available:
PSK, CCKM, and CCKM+802.1x. If you select CCKM, Cisco only allows
clients which support CCKM. If you select CCKM+802.1x, Cisco allows
non-CCKM clients also.
CKIP —Cisco Key Integrity Protocol (CKIP) is a Cisco-proprietary security protocol for encrypting 802.11 media. CKIP improves 802.11
security in infrastructure mode using key permutation, MIC, and
message sequence number. Software release 4.0 supports CKIP with
static key. For this feature to operate correctly, you must enable
Aironet information elements (IEs) for the WLAN. The CKIP settings
specified in a WLAN are mandatory for any client that attempts to
associate. If the WLAN is configured for both CKIP key permutation and
MMH MIC, the client must support both. If the WLAN is configured for
only one of these features, the client must support only this CKIP
feature. WLCs only support static CKIP (like static WEP). WLCs do not
support CKIP with 802.1x (dynamic CKIP).
Layer 3 Solutions
None—When this option is selected from the Layer 3 security drop-down list, no Layer 3 authentication is performed on the WLAN.
Note: The configuration example for No Layer 3 authentication and No Layer 2 authentication is explained in the None Authentication
section.
Web Policy (Web Authentication and Web Passthrough) —Web authentication is typically used by customers who want to deploy a
guest-access network. In a guest-access network, there is initial
username and password authentication, but security is not required for
the subsequent traffic. Typical deployments can include "hot spot"
locations, such as T-Mobile or Starbucks.
Web authentication for the Cisco WLC is done locally. You create an
interface and then associate a WLAN/service set identifier (SSID) with
that interface.
Web authentication provides simple authentication without a supplicant
or client. Keep in mind that web authentication does not provide data
encryption. Web authentication is typically used as simple guest
access for either a "hot spot" or campus atmosphere where the only
concern is the connectivity.
Web passthrough is a solution through which wireless users are
redirected to an acceptable usage policy page without having to
authenticate when they connect to the Internet. This redirection is
taken care of by the WLC itself. The only requirement is to configure
the WLC for web passthrough, which is basically web authentication
without having to enter any credentials.
VPN Passthrough —VPN Passthrough is a feature which allows a client to establish a tunnel only with a specific VPN server.
Therefore, if you need to securely access the configured VPN server as
well as another VPN server or the Internet, this is not possible with
VPN Passthrough enabled on the controller.
