200+ remote sites, 5M mpls to each, guest access is a requirement

fellow networkerz, my WAN today is all over the place. we're making a bold move to move all of our locations to MPLS with 5M ethernet minimum. For enterprise internet traffic, it will be tunneled to a pair of FP2130s (replacing SSG550M). we have a requirement to provide guest access (we don't use a ton of data today, and most locations have less than 10 users). does anyone have any experience or advice on tunneling guest access using the MPLS? Obvi we'll have ACLs in place to keep it off of enterprise networks.

any advice, or words of wisdom is appreciated. go!