Get a router that you can run DD-WRT on (The Linksys WRT54GL is a popular one) and use Client Mode.

If you consider the LAN/WLAN side of the primary router (that is, the network segment(s) between the primary router and the secondary router) to be part of "the local network" that the Guest Network devices should not have access to, then a secondary router cannot provide Guest Network access only to the Internet without cooperation from the primary router.

The Guest Network's traffic to/from the Internet has to cross the same link between the two routers as local network traffic. But if you want it segregated from the local network, it has to be tunneled or tagged in some way that segregates it from the local network traffic. But if that traffic is segregated through, say, VLAN tagging or some kind of higher-layer tunneling, the primary router needs to know how to do the right thing with that traffic (that is, decapsulate it and send it only to the Internet, and not let it route back onto the LAN).

I don't know if any Netgear equipment has support for this kind of "Guest Network Extension" functionality, where the primary router acts as a VLAN-aware device or tunnel endpoint so that secondary routers can forward segregated Guest Network traffic to it.

I know that Apple AirPort Extreme/Express/Time Capsules as of firmware 7.6.3 support this. If you have an Apple AP as your primary router (in NAT mode), and have Guest Network enabled, and another Apple AP as your secondary "router" (actually in bridge mode, not really being a "router" per se), also with Guest Network enabled, then the secondary AP will forward Guest Network traffic toward the primary AP, but will VLAN tag it so it's segregated from local LAN traffic. The primary AP also subscribes to the same VLAN, and knows to forward traffic from that VLAN to the Internet, but not back onto the local LAN.