Clients access permition

[YenLin]

Hi everyone, we are planning to migrate a vlan for clients.
In our environment, we've got mutiple 5400, msm 765*4, msm 460, msm 466 and around 450 msm 317.

The question is: what is the best way to do restrict clients to be able to access our servers' resource.

If possible, they better only can access internet.

There is an option on MSM controller to config wireless clients no access right to each.

But, it makes them also have right to access other vlans. As well as server vlans.

Currently, what I think is to use protected port on these ports.

It's much better than config a lot of access list on each vlan

Any one can provide better idea for this task?