id look in to a look in to a router or firewall (depending on your infrastructure) that can do vlans and set the two vlans for wireless abd private lan (yes you need compatible switches) and then set up a vpn server
look at pfsense
get a box (yes a normal pc will work with 3 ethernet interfaces. set one interface for the lan and then the second one for the hotspot network. connect them up apropriately with the apropriate firewall and routing rules (ie no routing between hotspot network and private lan).
For the hotspot look in to getting plain access points
For the vlan both pfsense and monowall support pptp and ipsec, pfsense supports openvpn(this is to my current knowledge m0n0wall may support openvpn now).