My apologies, I must not have been clear.

Let's call the DHCP server capability within the WLC "internal" and the use of a DHCP server elsewhere in the domain "external".

Using that terminology, I would typically recommend guest users pull from "internal" and everyone else from "external". Which is what I think you were saying?!?

That is exactly what I was saying. Guest would get their ip from the wlc. No need to open ports on the FW for that.

Can you think of any other cons of using the internal dhcp, other than the reliability of the server? My understanding was that it was simply not designed to perform that function and was just a bonus feature for demo-ing and speed of deployment (on a smaller scale, of course)...

I have used the wlc internal dhcp for guest use for a long time. Also in big installs where there are a few hundred guest users. Yes the WLC internal dhcp is not a "TRUE" dhcp, but if everything is configured correctly, you should not have any issues. Monitor the amount of dhcp address that are handed out, because that might be where it becomes a pain. Guest users will need an ip address to hit the webauth page..... So really take a look, since most of the time you will have the ssid broadcasted, is that wireless device utility might associate to your ssid not on purpose, just because how they have their device configured.... this will take up one of your dhcp address.