Setup is main Deco M5 is wired to the router

The 2 satellites are connected through the Mesh network.

Configured in Access Point mode.

The router handles the DHCP

Guest network configured with "Allow Local Access" is turned off.

Clients connected to the quest network do not see each other.

However the clients on the guest network can access the web interface of the Deco M5 AP's which should not be the case IMHO.