Let me preface this with the comment that you SHOULD NOT DO THIS
You can set the subnet of the "outside" interface on any "wireless router" that does nat to be a /30 that includes only your current router/firewall. It goes without saying that you need to make the rules on the firewall not allow traffic from the wireless router into the rest of the /24 production network.
Let's say your current firewall/router's config has 10.10.1.1/24 as the inside interface for your production network. Set your AP's interface to be 10.10.1.2 and it's outside interface netmask to be a /30 (or 255.255.255.252. Now your AP will send all traffic (that isn't in the wireless network) to the firewall. Make sure the wireless router is doing NAT and it isn't acting like a bridge.
router: 10.10.1.1/24 (production network)
AP: 10.10.1.2/30 (outside)
10.10.1.1 -> AP's default route
Lastly, if you want to put more APs onto this "wireless network" -- set all the SSIDs to be the same, reduce the power on all the APs, set them to different channels, and turn off DHCP on all but the one connected to the firewall, and then connect the "inside" interface of each new AP to the first AP's "inside" network interfaces.