Welcome to the Layer3 world Kevin. You will need L2/L3 switches, or multiple interface routers and L2 switches that understand VLANs. Our recommended design is to locate your ZD/APs on one "management" VLAN, and drop your wireless clients into separate/individual customer VLANs, where they can communicate with themselves, but not the other customers. You specify these VLANs under your user WLAN Advanced Options.