In firmware 3.x, you need to use vpn policy and choose if you need to use vpn for Guest wifi.
This way you can have two SSIDs, one via VPN and the 2nd does not.