Peplink Balance 20 with Guest network and failover

Use a Peplink Balance 20 with failover and two wireless networks (created using 2 Apple Airport Express devices), one for the private office users and one for guest users.

I want to ensure that the guest users are not on the same network as the private office users (ie: The guest network users should not have access to any devices on the network - They should have internet access only). I want to have a primary internet connection (cable) and a backup internet connection (mobile data plan). I don’t want to use the backup internet connection unless the primary goes down. So I want to apply QoS to the guest network users so they aren’t eating up a large chunk of the bandwidth from the primary internet connection. Once the router fails over I want to disable the guest network so that only the office users will have internet connection via the backup internet connection.

Here is the topology I will be using. Is this possible? How can this be achieved?

The first thing I want to do is setup the guest network and prevent guest users from accessing files on the private office network. I’m assuming this needs to be done with VLANs?