Backup to LTE without guest internet access

For a simple 2 Wan failover, the easiest would (IMHO) be Filo’s approach here (using netwatch), let’s call it “simpler #4”:
http://forum.mikrotik.com/t/simpler-failover-for-two-gateways-i-found-working/169108/1
The netwatch down script could be extended to include a “disable guest access” of some kind.