Sounds like you want to do a very complex setup.
We have a Management Vlan (vlan id 1) for all our Ruckus AP's and the controller.
All our dlink switches have vlan 1 by default on them and so their IP falls in this range.
We then have various other Vlans for servers and desktops.
We then created VLAN 100 for staff wifi laptops and Vlan 101 for public wifi guest and staff mobile phones.
You will then create vlan 100 and vlan 101 on every switch.
Tag vlan 1 101 and 100 on all switches on the ports joining to other switches.
On the switch ports where your AP are in untag vlan 1 and tag vlan 100 and 101.
I then blocked vlan 101 from accessing the company vlans on the core switch.
Setup 3 Wireless SSID's on the controller
Corporate Wireless vlan ID 100
Guests and staff/student mobile Wireless Vlan 101 and create dhcp schopes for them on the DHCP windows server.
I had to give Public DNS server IP on the Guest / staff mobile Vlan because they cant reach our internal DNS server. You also want to allow dns out on the the firewall to these dns servers then so they can resolve names,
We went a step further and and setup a radius server for the Corporate wireless SSID and in the radius server setting set only allow domain computers to connect.
So their is no wireless key to enter. If their pc is not a member of domain computers they cant connect.
The students / staff mobile Wifi uses Captive portal with AD authentication so they login with their user account and password.
Guest wifi tokens or passes are generated by myself once a week and forwarded to reception for guests.
Works flawless in my environment.