Thanks for the link. I'd found some solutions that involved pushing an SSID and info using Apple Configuration, which we use to lock out other features, but I assume we'd have the same problem as soon as the secured network stutters, and the patrons connect to the open network.
We have no control over the open network, as both networks are campus-wide for our university, with the guest being a visitor courtesy, and the other requiring a university login. The best solution so far, as your link suggested, is to "impose some type of controls on your internal wi-fi networks," for which I'm thinking MAC filtering if our IT department is willing. It's not an ideal configuration, but it should accomplish what we need to happen.