Just create a second VLAN for your guest and make sure the uplink ports have the VLAN tagged all the way to your server that is performing the routing/NAT. So tag the new VLAN on the edge port the server is connecting to as well.
You have to make sure that your server NIC does understand VLAN tags. If it does not, you will need to get one that does or install a second NIC that will be dealing with the additional VLAN/Subnet.
On the edge port where your access point is connecting, make sure that the guest VLAN is tagged and your main VLAN is either tagged or untagged, depending on the configuration on the access point.
When creating your WLAN, make sure that you specify which VLAN each WLAN has to use.
So for Main SSID you can say VLAN1, and your Guest SSID, VLAN2. This will make sure that the connection is placed on the correct VLAN once a client connects to the AP.
For the guest subnet, you need to assign a range of IP addresses, with your server being the gateway.
You will also need to deal with DHCP on this VLAN so you need some kind of DHCP relay-agent on the server but I am not 100% sure how this would be configured on your setup, not knowing all the details. Normally you will confiure this on your switch that has the vlan interface configured, which in this case I believe would be your server. If this server is also a DHCP server, then I think as long as the new DHCP scope has been created, you should be all good.
Get pfsense to do the routing from your guest VLAN to your WAN interface but do not allow it route to the main VLAN and obviously configure NAT to allow this new subnet to get out to the Internet.
Hope this helps you on your quest.
SleepyMan