You need to create 2 VLANs on the AP. The consequence is that you need 802.1q support on the ethernet switch where the AP is connected.
The current restriction on Cisco Aironet product is that all SSIDs in the same VLAN must share the same encryption. This restriction also applies to non-VLAN environment.