I was trying to keep things in a similar mode to my mind which is unfortunately simple.
A lot of the zentyal network management involves the usuage of network objects.
The simplest is a single declared IP with it partnering mac address.
Its a bit of a catch-22 scenario when it comes to simple minds and lazy sysadmins such as this one.
If I dont want to do it by defining mac addresses then there is the next level of ranges or scopes.
The next level of object is a network scope where you don't assign all the mac's
So either you have a separate nic interface with its own dhcp and own subnet and the network object is that range.
You have one of these for each specific network object range.
Its sort of plug and play range grouping at the patch panel, where you patching will result in different network access rights.
Probably the easiest way is to get a vlan capable switch that way you can use a single nic but segregate by vlan.
Each vlan has a dhcp server scope and its own subnet and its own network object range.
That bit is fairly easy as you can have several network object ranges in which zentyal can apply various rules for in various modules.
Then you need to start thinking of shared resources and back at the server apply the routing to get these subnets to talk to each other.
Being simple I have never tried it out, but keep meaning to as it does allow much control over the network based on the owner of a desktop.
I have to say I wish Zentyal had a further level of abstraction from IP to users and groups, as maybe this would make things more digestible for my simple brain.
If your wireless router or lan is connected to a vlan compatible switch all should work as its the switch, that will do all the clever work.
So really I would say use vlans and the switch manufactures software for grouping and aggregation. I have a lovely cisco 2970 catalyst and from experience, 3com are much easier to use. Maybe one day when I am suicidaly bored I might read the cisco documentation and do it.
There are ways to do it with out a vlan capable switch and I guess you could virtualise
http://openvswitch.org/ and as long as you have the nic logistics correct it should work.