@LittleJohnuk 

What Access Points are you using exactly?

If they support SSID vlan tagging this should be easy with what you have

Leave the default network alone, PVID 1 or whatever

create network "Staff" Tag 10

create network "Guest" Tag 20

Connect the Access points to the router ports.  The ports will already carry the staff and guest networks and have them as tagged.  Set up the access points with an IP on the default network which is now your management network

Setup the access points

SSID 1 - "Staff" - Tag 10

SSID 1 - "Guest" - Tag 20 - Activate Guest Mode

Set up Gateway ACLs in the controller, type "LAN<>LAN", Protocol "All"

Source "Guest" - Destination "Default & Staff" - DENY

Source "Staff" - Destination "Default & Guest" - DENY

Source "Default" - Destination "Staff & Guest" - DENY

This will isolate them all from each other

Back to the router, Set another one of its ports as PVID 10 (Staff) - this will set it as untagged on the staff network for all your point of sale etc stuff  If you need more ports either get a little omada switch like SG2008P (for POE to your access points) or a dumb switch can excent the "staff"wired network hanging off the port you just set the PVID on

Now, the staff WiFi can access all the point of sale stuff.  Guest wifi can only access the internet.