You dont need a Layer 3 switch as this can be done via VLAN's which are Layer 2
You can seperate client and management access by changing the wan ip address on the AP.
Prior to setting the IP address on the WAN make sure that port on the AP that is connected to the switch is set to trunk:
set interface eth0 type vlan-trunk untag 1Note: it may be eth2 if its a 7363
IP Address Commands
set ipaddr wan vlan 10 dynamic
set ipaddr wan vlan 10 10.10.10.2 255.255.254.0 10.10.10.1
Then for client traffic just adjust the access VLAN in the WLAN config.Note:the ports facing the AP's, and the uplink ports between switches, need to be set to trunk (tagged frames), and allow the VLAN's for both MGMT and client traffic