Vlan & Canopy

I have two SMs both registered in the same AP, there is any way to separate the SM1’s traffic from SM2’s traffic like if I was in a VLAN? So if SM1 runs a packet sniffer cannot see SM2 traffic?

In the most of the cases I cannot do NAT in the SM form many reasons (some limitations still have this feature in the Canopy among other things), so I was thinking in tunneling the traffic throught a VPN, but I will need aditional equipment in each subscriber. Did you know any other better way? Any suggestions? Thank you for all the help you can give me.

Best Regards,