@Voidnt 

Hey

If you are simply after AP Isolation, namely each client won't be able to communicate with each other.  Then this is called GUEST NETWORK and is available under SSID settings.

Same concept, different name just

Hope that helps!

  @Philbert I tried it but it blocks all private network traffic, rather than forcing all intra-SSID traffic through the router so that it gets filtered there.

It also turns out that these features are merged in Omada Controller now too.

  @Voidnt 

Yeah, the EAP range is for business and is really designed to be controller driven

You can run the controller software locally from a Raspberry Pi or PC you have spare, its FREE.   You dont actually have to purchase a controller.

I would like this feature too, but this can be workarounded using EAP ACLs.

Guest network is "client isolation" + "private subnet blocker".

You can allow traffic to public network(s) in ACLs. I allowed there traffic to another VLAN and to gateway.