Cisco Wireless :: 5508wlc Separate Guest And Company Wifi Access?

We have;

3 - 5508WLC
1 - 4402 WLC
Cisco Prime 1.3
25 - 3502i

We have 25 remote sites that use MPLS back to the company HQ that has one connection to the internet.Also at the HQ we have a seperate ISP connection.The remote sites and HQ have AP's which provide internal company access.  We would like to have a seperate Guest WLAN at these remote sites to provide access to the ISP connection at the HQ's.  Do we need to have an anchor controller? From documentation I have been reading it looks like anchor controllers are mostly used for networks that have a single connection to the internet and they use the FW to control/ secure the guest and company network from each other.  Is there a differnt way of seperating the guest wireless and company wireless network securely from each other but use the same WLC's and AP's??