You can very quickly do bandwidth limiting for a certain network or range of IP addresses.

Create an ACL for the traffic to do bandwidth limiting on. It is required to have a separate ACL as the QoS policy has to be applied to a specific ACL.

So, suppose the internal address range that needs to be limited is the network 192.168.1.0/24, then this would become:

access-list guest-wireless-bandwidth extended permit ip 192.168.1.0 255.255.255.0 any
access-list guest-wireless extended permit ip any 192.168.1.0 255.255.255.0

Next, set up the QoS policy:

class-map qos
match access-list guest-wireless-bandwidth 
policy-map qos
class qos

Provide bandwidth limitations (in this case, it's set to 10Mbps):

police output 10000000
police input 10000000

At the moment, the policy is active on the ACL, but it's also required to explicitly enable QoS on an interface. In our example, the physical interface is GigabitEthernet0/2, configured as a trunk port and VLAN 112 as the interface for our guest wireless.

service-policy qos interface GigabitEthernet0/2.112