Hello,
Thank you for your post here.
From the description, you have a wireless network for guest and want to restrict the access from IPods.
Beside the user authentication and authorization via certificates for WPA2, I think that MAC address filtering would be the most easy and direct method to restrict the access from IPods. To get the full prefixes (also named as Organizationally Unique Identifier OUI) from Apple, you can get the full list of OUIs from Apple.
IEEE OUI and Company_id Search
http://standards.ieee.org/regauth/oui/index.shtml
If you have any questions or concerns, please do not hesitate to let us know.