If you plan to replace your main router that has direct internet access you can get a router that has "guest" ssid ability. Many of these have a option to only allow access to the internet.
Now if you are just going to add a wireless device to your network you are going to have to use security filters. In your case you would want to only allow connection to the proxy server. You would then have to instruct people how to set the proxy. There are many routers that have security filter ability.
The second option I would tend to prefer since it is not wide open internet and you have a proxy server to prevent most abuse. Problem will be if someone wants/needs to run a IPSEC based VPN.
The method I know will work would be to put a router in as normal. Put the WAN ip as some ip in your current subnet with a proper gateway. You would then create a new lan say 192.168.200.1/24 and set the DHCP server to give out 192.168.200.xx ip to your "guest" network. You then put in a security rule that says only allow traffic to the proxy server. You then must configure each pc to use that proxy. From the proxy viewpoint all the users will come from the same IP that of the router.
A second method that may work would be to define the router as a AP. This makes it transparent. The users would get their IP from your main dhcp server...ie they would be on the same network as all your devices. The key part I do not know if you can do is put security filters in that restrict traffic to go only to the proxy. Many of these devices can only filter traffic wan-lan traffic. In addition you would have to put in a couple of other security rules for example you would have to allow the devices to talk to the DHCP server to accept the ips they were offered.