there might be a way to do it using VLANs, but I'm not export, I have a completely dedicated router serving my IoT (same as guest lan, no LAN access) devices.
this could be helpful too Guest network on dumb AP with VLANs - #4 by darksky, esp the last video.