According to your needs, the best way to do this is use different VLANs to match the right services according to the need of each SSID, as by default LAN port of AP is Trunk, you can create on your Switch a Mixed or Hybrid Cofiguration, using access VLAN for management and Tagged VLANs for services, in this case you tag the VLAN with the proper configuration and DHCP scope and in the WLAN configuration you click on show Advanced Options and go to WLAN Priority TAB and type the number of the corresponding VLAN for that SSID in Access VLAN, by default is 1.
Once you do this and Apply the CHanges, your devices connected to this SSID will be able to get the IP address from the pool configured for this VLAN, and the traffic can be configured according to the Policies for this VLAN.
Thanks. To be clear though, in this approach, I'd have to have a second ethernet cable from each AP to the switch (tagged ports) to be able to use the second tagged VLAN. Is there a way to avoid the second ethernet cable (why we were considering a conditional DHCP server for just that one SSID).
The purpose of a tagged network or VLAN is to transport multiple networks over a single wire. If there multiple wires involved, then the separation of the networks is physical, no need for tagging.
Your switch should be set to use a trunked port, and each VLAN will have a network-id or vlan-id. Your AP connected to that port will tag each WLAN traffic with the corresponding VLAN tag. For example, WLAN-1, -2 and -3 will have tag (or vlan-id) 3 and WLAN-4 will have tag 4.
Thus, on the switch and further upstream, on the router, vlan 4 will have its own router IP (or gateway) and you can enable DHCP on it, defining a subnet on that VLAN.