An easy configuration might be to put everything on the "wireless" side in it's own network and route between them using a couple static routes.
A few years ago did a pilot project for a "simple" secure wireless solution , we put in a bluesocket device w/1100 waps behind it. It was a pretty simple setup except the wpa supplicant wasn't too far along for xp. We used the bluesocket device for authentication using ldap to the directory and setup roles on the bluesocket device. The role had connection requirments i.e. ipsec connection from client to bluesocket device and these role dictated what you could connect to bandwidth etc.
