I'd talk to Orbi to see how they solve this since the secure guest here has always been another SSID on the WAP.