I can only come up with complex solutions to your exact requirements.
However if you can relax the requirements so that anyone can access the printers, instead of just employees, then add a wireless firewall rule above the "deny" rule, permitting access to only the printers IP address.
Here is a screenshot of a pretend configuration.