The AirPort Extreme's manual says the following:
Create a guest network with or without password protection, to provide Internet-only access to wireless devices, such as computers, iPad, iPhone, iPod touch, and Apple TV.
But is it possible to have an ethernet port on the AE that connects to this guest network, so it can go to a guest user that is out of the wireless range? (to plug into a wap)
Best Answer
Unfortunately that is not possible, anyone with wired access to the AEBS has full connectivity, and also skips any other access restrictions or authentication for that matter.
However, you could use an AirPort Express for example to create a second guest network. When creating tgat network, you can use the same SSID as the guest network configured on the AirPort Extreme (make sure you also use the same encryption parameters and password) and clients will transparently switch to the one with the best signal reception while moving to different locations.