Hi chaps

We have several AP800s here and a 2820 handling the internet. The 2820 is attached to two WAN connections, a cheap DSL and a fibre box.

The 800's all have two SIDs set up, one for INTERNAL and one for PUBLIC.

We want to have users on the PUBLIC wlan network be able to only access the DSL connection and not to be able to access any internal resources, ie servers, printers, etc.

Firstly, is this something we can do via the vlan settings on both boxes, and if so, are there any idiot guides to vlans in the draytek environment as this would be the first time we have set them up.
Secondly, currently the PUBLIC users get their DHCP provision from the office server, the one that we want to stop them from being able to access. Is there an easy way around this? Can we assign DHCP services to the AP800s for just one WLAN?

Thanks

Olly