I've set up virtual networks in Tomato and multiple Wifi access points, and bound each access point to each network. Then, with iptables rules I've allowed/disallowed connections from/to each. I can write it up if someone helps me reproduce it.