I know it's heresy, but about the Apple Extreme Base Station...

[richorlin]

You can't use just one router and two bands. Both bands will be on the same network so they are not segregated. Gilbert's solution is the correct one: two separate networks. But I think the secondary routers will still be vulnerable through the primary router unless you firewall them.
The only way to keep something totally secure is to keep it off the internet. LOL