As you know, even consumer products like the Apple AirPort Express base station can provide a main network with access to everything, including "internal" resources like printers and NASes and shared computers, plus a "guest network" that only has access to the Internet.
The thing that's really unique about your request is this "in-between" network you want, that has some, limited access to internal resources. I wouldn't be surprised if one of the Linux-based aftermarket firmware distros like DD-WRT, OpenWRT, Tomato, etc. could do what you want. You'd want to find one that supports publishing multiple SSIDs, each on a separate VLAN. Then you could configure routing between those VLANs, moderated by firewall rules that decide which devices and services are reachable from which VLAN.
While I'm also sure DD-WRT can do this (with 2 SSID's, not sure about 3), I haven't actually tried it myself. Anyway, here's a write up to get you started.
– hyperslug – 2010-07-07T00:32:53.217