wifi w/ splash page

the client machine will join wifi networks in the order they are listed in the preferred network section.
You could create a script to ensure that your preferred network is always at the top of the list.
you could limit changing of networks to admin only users.

We have a policy that removes the open networks our users add in spite of our best warnings that they can not connect to printers/servers/shares on our district (corporate) network. Under files and processes we run:
networksetup -removepreferredwirelessnetwork en1 "unwanted SSID"

edit without the quotes

@End Take a look at this Krypted article which discusses pushing wifi configuration on Mac OS X.

Krypted.com - Pushing wireless networks out

You're looking to use networksetup with the -addpreferredwirelessnetworkatindex and -removepreferredwirelessnetwork option.

Edit: Looks like @wdpickle beat me to it! :-)

Thanks for the response everyone! It's looking like I have to remove the guest SSID upon log in. Hopefully that works. I'm thinking the reason the client connects to our guest wifi is because there's no authentication needed before connecting to the SSID. Whereas our corp wifi takes a little bit to connect and uses AD authentication. I could be wrong but if anyone has any thoughts that would be great!

It actually has more to do with the order of the Preferred WiFi network entries on the Mac than authentication. If you open up the Network Preference Pane, click on Wi-Fi, then on Advanced, under the Preferred Networks list, I'm willing to bet that the open Wi-Fi is the first one in the list, or at least before your actual preferred protected network. Items at the top of the list will get connected to first (if in range)

Just so you know, if you connect to a Wi-Fi network and leave the box called "Remember this network" checked, it adds that Wi-Fi SSID into the Preferred Network list, at the top, above all other ones. Meaning, yes, you will likely need to have a LaunchAgent check at each login (and possibly also on a StartInterval setting) to remove that entry if its there, since every time someone connects to it, it will create that entry again unless they uncheck that box.