@ChrisAhlund 

Don't bother with blacklist: smart kids with modern mobile devices can connect to your WiFi with randomly generated MAC addresses, making blacklist useless.

The only option you have is to change password on Main Deco network. Choose strong one, and don't share it with anyone in your household. You will have to update password on all your mobile devices in household by yourself. 

There are ways to figure what the WiFi password is on device connected to Main network, but hopefully your kids will just share Guest network SSID and password with their friends. Explain to your kids that sharing Main network with their friends could badly impact your kids Internet experience, and that might be enough of incentive for them not to figure what Main network password is.

@Alexandre. Damn it, didn't think about the random MAC address... I hoped there would be another option besides changing the password since I've got a lot of smart devices that I don't want to reconfigure again.