Configuring secondary unit as AP with 8021.11r roaming and isolated guest

Hi everyone, I have a good bit of experience (~5 years) messing around with OpenWRT, but all of that has been on a single-instance router using a TP-Link C7 as both router and AP.
Recently, I’ve had to add a third party (wired) Access Point (TP-Link EAP225v3) to increase coverage.
However, I’d like to replace the EAP with another C7 (I have a spare) running OpenWRT 18.06.4 (same as the main unit) and configured as a simple AP, but one that supports 802.11r Fast Roaming, so the household iPhones seamlessly switch APs while on WiFi-calling calls.

A basic setup I think I can figure out, but where I’m getting stuck and could use some help is the fact that my main router AP also hosts an isolated guest network. And I’d like that isolated network to also be replicated on the secondary AP, maintaining not only WiFi to WiFi client isolation, but also subnet isolation. On the primary router that is achieved by associating the WLAN to a ‘Guest’ firewall zone, but how to configure on the remote AP (since no local fw zone there) ?

It strikes me this would be a fairly common scenario in homes, especially as the 2.4Ghz band gets overly congested and additional 5Ghz APs in the home would allow for improved performance. And people want (need IMHO) to set up isolated ‘Guest’ networks for IoT devices.

Thanks in advance.