Cleaning up WiFi with client separation

I run a campus wide hotspot over 9 buildings.

It works but performance can be spotty. Since its running hotspot it has to operate over a giant bridge over all 9 buildings.

We are using CAPsMAN and CRS125 switches however I am having an issue with the CRS switch chip.

I can eliminate local forwarding from AP client to AP client but once it hits the CRS125 bridge it is poorly documented how to perform port-isolation using the switch chip features.

Anyone else performing true client-to-client isolation with CRS switches?