Hospot: How to do selected client isolation?

I have an MT box with 2 interface cards: WAN and LAN. I’m running hotspot on the LAN interface as well as several fixed IP clients that are “bypassed”. A couple of the bypassed clients are our own computers and the rest are our users. When I was using v2.9.7, all of the bypassed clients could not communicate with each other. Now that it is upgraded to v2.9.10, all of the bypassed clients can communicate directly with each other. Is there anyway to set it up so that only our own bypassed computers in the LAN can communicate to each other, but at the same time not letting our other bypassed clients do that? I think what I want to do is basically beeing able to select which bypassed clients can communicate with each other, and which other bypassed clients cannot?

I have problem when some bypassed clients exchange huge files directly among them and bog down the wireless network. So any ideas would be appreciated! Thanks!