Hi Robert,
I would also suggest you also consider looking at switch models; SG300-28P , SG500-28P as a replacement to the SG2000P: These switches that I have mentioned, like the SGE2000 are in Layer 2 mode by default. You can change the switch mode to run in Layer 3 mode.
We also recently also introduced into Cisco SMB, the new WAP321 or smaller WAP121 which should be considered as a replacement to the WAP4410N . ( the new WAPs also have the advantage that they come with all mounting hardware and look aesthetically pleasing to the eye)
Your description of the configuration sounds fine, but there are many ways to perform the task.
If you were to stop the Guest VLAN within the switch, as you suggested, you would have to also perform a DHCP relay and be confident that your WAN router could NAT and allocate IP addresses to the Guest VLAN.
Allow the VLANs to propagate to a VLAN aware router or security appliance, that can take care of NAT and DHCP services for the guest VLAN makes your configuration task easier.
Having the managed switch in the configuration also means you can apply a Access-list to further tie down the Guest VLAN to they do not have access to corporate services.
Like the SGE2000P and WAP4410N, all devices mentioned are easy to configure via a GUI and VLAN aware. However the switches, I have mentioned also incorporate a supported Command Line interface.
Hope this brief reply is of help.
regards Dave
