Having it saved with a bad password may result in the user consistently getting on screen prompts that it cannot be joined. I just have a script that deletes the guest network if they are not currently on it that runs once a day. It has not solved the guest network woes, but it significantly reduces them.
@gquattro Not by using a network profile, but the approach I'd take if I really wanted to make sure someone didn't connect to a guest SSID would be to have a script that would check to see if the guest SSID was the active SSID, and delete it if so. I'd use a LaunchDaemon triggered by a network state change to run that script.