You kind of lost me at "ISP modem bridged to issue public dynamic IP address", so I always recommend
your local VAR or Ruckus SEwho are best at exploring all options to provide a solution.
But I'll see if I can picture it. If you use one R300 in Solo/Standalone mode, you can 'bridge to WAN' for an
SSID that you trust on the AP network, or use NAT and 'route to WAN' with an Internal DHCP scope for the
second SSID like guests.