Hi
i came across this post because of being cited before and since the first part of the question is still not marked as solved and it sounds similar to what i had build i may can give a hint
but also since a lot is going on in the thread already sorry if any of this was suggested before...
so first of all you usually can set client isolation in the wifi config of OpenWrt which should work for single ap devices but obviously not with hole vlans. the batman isolation is from what if have read merely an extension of this exact feature so probably also not doing what you want in the long run.
if you really want to do that then you are probably on your own doing low level network configuration. which still might be hard because batman is considered a layer 2 technology so i am not aware if firewall rules are even working on this level
a quick search brought up this post by jeff for me which may be related