Site to Site split tunnel

Hello Fellow Nerds! (Admin it, we know how to subnet, that makes us nerds)

I have a dilly of a pickle for you. I'm currently trying to set up a remote site that has a site-to-site VPN connection to our central location. Fine, simple enough. We have the SonicWall ordered in and all I have to do is set it up. BUT WAIT. They want guest access at this location.Now, because of some mumbo jumbo, I can't just create a separate SSID for the guest wireless (Did I mention that the only hard wires are going to be to the AP's and a printer?). I need to separate the guest traffic from the enterprise traffic (HIPAA thing).

Oh yea, I also don't have access to an actual switch. I'm going from a SonicWall to an Edgerouter 6P.

What I'm here to do is ask this cuddly bunch if there would be a best way to go aboot this. My current thought process is to separate everything out through VLAN's. But I need to know if you can set up Ubiquiti's AP's to segregate SSID's by VLAN.

Can you have traffic coming from the same AP go through both a VPN, and out to the open internet, based completely on SSID?

As always, any help is greatly appreciated!!

~Edit: Spelling