So far, here's what I've got:
Set up an AP10. Used essentially the default config, edited the wireless network configuration to set it to WPA2/WPA Personal/AES, set up a passphrase, and set the DNS and default gateway handed out to the interface address for wlan0.
I'm connected to it and it's working, in this configuration, as an isolated guest access network.
Set the wireless network to be allowed to use the http proxy, disabled the packet filter rule created by the wireless config, and it's still working -- now through the proxy.
With client traffic set to "Separate Zone", it's completely isolated from our LAN. Nothing flows back in... nice. So it seems this is a good solution whether you want to use the proxy or just let the guests have unfettered access.
So far, I've only tested a win7 client on an HP DV3085 successfully. An IPAQ I have was unable to negotiate a connection, and an older HP laptop running SLED11 wasn't able to bring up the interface. Haven't done much poking at that yet.
Seeing a connection speed of 72.2M on this connection. Interesting.