Seperate network?

[drag0n_45]

Hello there,
I'm hoping that someone can help me with this network issue. I'm trying to find a way to seperate a wireless access point from the rest of my network, only allowing internet traffic through - nothing else.

I've got a few HP Procurve switches, and a run through my building about 100 ft long. The run connects to a unmanaged switch, and there's a WAP and a wireless router connected to the switch. The WAP is secured, the router is unsecured. I use the secured one for folks that come into the building and have the passphrase - it allows a connection to our server, our printers, etc. I use the unsecured one for guests. It SHOULD restrict access to all servers and such, but doesn't. Access is permitted to our servers and our printers without a problem - they just can't be locating by browsing.

I purchased a managed switch in the hope that I could configure a specific port to do what I'm trying to get it to do, but I'm a little confused.

I've tried VLANs, but VLANs are much more restrictive than I though - blocking all traffic, as if there were literally two seperate LAN's. I noticed an option for using a RADIUS server, but I suspect that traffic would be the same once authentication was completed.

I know that I could get away with this with another run and a VLAN configured in the main router, but I don't want to have to drop tiles, run wire, get the snake, put a plug in, etc.

Is there any way to only block network browsing protocols, only allowing internet access?

As I was typing this, I just thought to restrict all traffic not on port 80...will need to look into that though.
EDIT: I couldn't find any options to do this, but this wouldn't work anyway, as I'd want to allow other traffic, just not to the rest of my network. Maybe I could set up a special subnet mask for the router to only be able to access the gateway? I don't know anything about how to create one though...

Does anyone have any other ideas?