How to measure the local network traffic and load

You can just place the NAT routers in series, one behind the other. The first NAT closest to the Internet connection can be the wireless with access to only the Internet. The second NAT can contain the wired network and its wireless capabilities can be disabled as well.

This configuration will protect the wired network from the wireless network. Just ensure that both NAT networks are not on conflicting IP plans.

The only ways I see at the moment is to have VPN running on the network or use IPSec policy's to do this.

IPSEC is the network layer encryption designed specifically to cover this case (among others).

If you do not want to mess with it because of the complexity and cannot use HTTPS throughout for some reason, you might consider relying on your network equipment's isolation features. WPA2-enterprise encrypts client-to-AP traffic and is not susceptible to man-in-the-middle attacks due to a secret shared among all users as WPA-PSK would be. Managed switches allow either for locking down the MAC forwarding database or using authenticated connections (802.1x) with a MAC address lockdown so MAC spoofing attacks allowing authenticated users to sniff on other user's data would be mitigated. This would not protect your users from a direct tap on layer 1 though (e.g. a hub or a wiretap device installed somewhere between the switch port and the user's laptop ethernet jack).