As long as you can add the SSID with the group policy, then you wont have to touch the clients at all. They will connect with the old ssid, and pull the new wireless policy down. Just make sure the new SSID is higher on the priority list.
As for the APs, you will have to touch each one of these if you don't have a central management platform. You can have two ssids on them, so create the new ssid along side the current, and assign it the current security settings and vlan assignments.