Hardware suggestion for wireless access point

Well most routers on a Sub Net will prevent browsing the the Internal LAN but there are other problems that you need to consider first.

WiFi connections have a fairly decent range somewhere around 500 yards so anything within that range is able to log onto the system and download data. If this is Kiddy Porn or Terrorist Material you or your company will be responsible for that Download and when the Feds come Knocking on your door it's your responsibility that you or none of your people or anyone associated with the company was involved in the download and you have to tell them who was responsible for making the download. Even then depending on what it was that was downloaded you can be considered as an Accessory to the crime so the best thing to do is have a hardwired access point available for visitors to log in through.

That way you have records of who was using what when and have some legal protections in place but if you go WiFi there is nothing to prevent someone parking outside with a NB and charger and spending all night downloading Illegal Material which you can not prevent. Of course if this Wasn't gong to be a Public Access Point you could lock it down somewhat but there is no 100% intrusion proof method currently available.

Col

The cheapest and most simple way to do this is to provision a seperate DSL line for the lobby access and do not go near your company network. Then you just buy a simple DSL router/AP, configure the security appropriately, and you are done.

To do it through the company lan would involve buying an 'enterprise class' AP such as a Cisco, designing and provisioning a VLAN and special firewall and proxy rules, deploying a IDS/IPS (Intruder detection/prevention) system while, at the same time, risking the legal issues if your lobby visitor or his friend in the parking lot downloads 4gig of MP3 files...leading to a love-note from the RIAA about illegal content downloaded from your IP address.