I'll probably start with Aruba switches. They have a nice firewall feature set and they're much less than Cisco's Wi-Fi switch architecture. You also don't need to do VLAN's because it does the firewalling based on the user's group membership which is a much simpler way of securing the network. It will support VLANs but it doesn't really need to do that.