the iTunes computer will need to have 2 NICs, one for each VLAN. If you configure IP helper-address on the vlan interface that serves as the default gateway for the "unsecure" vlan, it will forward the DHCP request to your DHCP server. Since it does need to tie into your regular network for this to work, you may want to put an inbound access list on the VLAN interfaces also, which denies most traffic other than DHCP broadcasts. This would provide some security.