Edit: Solution found - making a gateway ACL LAN-LAN works just fine.

I am on the topology below trying to configure a unidirectional ACL rule. However it forces me to a bi-directional deny. The answer on other post mentions it should work with tp-link router, assuming...