Multiple SSID with Private LAN

Hello,

My company needs 2 Wifi SSID.

One for guests(onky internet access without can has access to the LAN)

and one for users in the company (with access in LAN and Internet

I have the following equipment:

Cisco Catalyst 3750

Cisco WAP 200.

I have create teh SSID's

SSID Public = For Guest wifi

SSID Private = Wifi fir the users in the company.

I have create 2 VLAN in Cisco Catalyst

VLAN 100

VLAN 101

I map with the VLAN ID from Cisco CWAP200 with the Cisco Catalyst.

My problem is that the public SSID i don't want to has access in the LAN of the Company.

Now it's working BUT from any SSID if connect has access to the LAN.

Can you help me someone?