@DanTheMan827,
As far as I am aware, there is no real form of AP isolation that can be used when the Decos are operating in AP mode, as your other router in the network is managing the connections, firewall rules, and network. The Deco is only following the instructions of what is sent to the device. Essentially, the data is not isolated because the data still has to be fed back to the main router, where it is only then managed and secured.
For most of our decos, there are options to isolate the guest network when it is operating in Router Mode, which would broadcast a separate SSID that can separate your guest devices from your main network, or allow you to completely disallow guest devices from interacting and seeing devices on the main network.