Can this be done?

Problem: I have a secured wireless network in our office, CISCO hardware, but I would like to allow unsecured access to the internet with no visibility to our internal network. I would like for the unsecured connections go out to the internet and surf un-hindered but I want to explicitly deny access to the internal network. This is a medical facility so security is the utmost concern; the unsecured wireless connection is an added service we would like to add for out patrons.


Question: Is this something that can be done without adding additional equipment? If so how or where do I start looking?