As you know, even consumer products like the Apple AirPort Express base station can provide a main network with access to everything, including "internal" resources like printers and NASes and shared computers, plus a "guest network" that only has access to the Internet.
The thing that's really unique about your request is this "in-between" network you want, that has some, limited access to internal resources. I wouldn't be surprised if one of the Linux-based aftermarket firmware distros like DD-WRT, OpenWRT, Tomato, etc. could do what you want. You'd want to find one that supports publishing multiple SSIDs, each on a separate VLAN. Then you could configure routing between those VLANs, moderated by firewall rules that decide which devices and services are reachable from which VLAN.