How do I setup a Guest LAN access via a seperate interface?

Hello,

I'm looking to setup a separate Guest Wifi AP with direct Internet access with some QoS to limit bandwidth usage (We don't have the best upload, so it needs to be limited).

I've got a full private network with its own Wifi AP.  However, we just acquired a second Apple Wifi Extreme AP, that I would like to use solely as a Guest Wifi AP.

Here is what I have done so far:

My UTM Has two unused Ethernet Ports.

I have setup one as a "Guest Network" Interface with an IP of 10.0.1.1 (My Internal network is a 192.168.x.x). 

I have it directly wired to my Apple Extreme AP (ip: 10.0.1.2), I have setup DHCP on the AP for a range of 10.0.1.100-150, subnet 255.255.255.0, DNS 8.8.8.8 / 8.8.4.4, gateway 10.0.1.1.

I can connect with no problems, however I keep getting an IP from my INTERNAL DHCP server, instead of the AP.

I have tried setting a firewall :

Guest Network > Internal = DROP

Guest Network > Internet IPv4 = HTTP, HTTPS, SMTP SSL, DNS, allowed.

NAT: Guest Network (Network) > External (WAN)

Yet, after all this, I'm still able to see my internal network, and get an IP from my internal network.  

How do I setup a separate interface to forward all traffic directly to the internet, and apply a QoS to that interface ONLY ?