Yes...the guest traffic - after firewall filtering - will be on the internal network. In order for this to work, then the controller is the guest's gateway.
If you go with your original design, then there is no "awareness" of the internal network unless you get creative in the upstream router/firewall.