for any readers of this undocumented buggy features.

if you use ip address reservation. any devices in the "main network" either with static or reserved ips are always shared to the guest network.
I assume the address separation is gone all at the dhcp level and is buggy as hell.

if you have any servers or nas etc with static ips or iot devices u want to reserve.

1- DO NOT enable guest allow network as these are shared by default.

2- AP isolation on the main network is wonky it only prevents the wireless devices provisioned with dhcp to not see other devices provisioned with dhcp. it will always show the static and reserved ip sets regardless. For my use case I left it enabled and it just prevented access within the only 2 devices in the main network with dynamic dhcp allocation.

IMO this is a lame way to implement network isolation and firewall ruling.
At least it could be better documented in more complex scenarios and not let users to discover and think its a bug.

Although it looks and feels like a buggy implementation while is not.
 

what a secure network looks like is

1: devices in LAN ports

2: devices in main-wifi

3: devices in guest-wifi

devices in lan can access internet and can see main and guest wifi devices.

devices in main-wifi cannot see devices in guest-wifi but can access lan devices such as nas or dns server.

devices in guest-wifi can access lan devices such as a nas or dns server and internet but cannot see main-wifi devices.

this has eternally been impossible in tplink routers. always one side does not work and leads to compromise. if you enable in guest that devices have access to local they can see the wifi devices in the main wifi network. allowing my guest for example to scan my network and discover my phone when they should only discover my nas.