AP Isolation from LAN

Hello,

my connection looks like:

DSL Modem <->TP-link Router ↔ Switch ↔ Metal 2HSPN

Need to isolate AP users from LAN. How can I do that?

Edit:
I’ve done it by myself, in ip/firewall by adding rule blocking any traffic to LAN SUBNET exept Gateway from ethernet interface.