If you only want to separate by using different SSIDs (so Guest and Non-Guest) you can go with the VPN policy called Based on the VLAN. After you select it there will be a prompt for which VLAN you want to enable it: