The wireless DHCP subnets can access the internal network via the port we are managing the controller with (this is a 7010 running OS 6.4.2.10). The only way I've found so far is to shut that port down and manage the controller out of band (console connection)