hotspot

Hi all. I turn on the hotspot on my routerOS (auth from radius) and it works fine. Then i create user “guest” on routerOS and set the speed limit, it works ok too. But i want to deny to user “guest” going to 10.0.0.0 subnet, while all others users can going to 10.0.0.0 subnet and to internet too. How can i make it? Where i can to user “guest” set some rules in firewall, any ideas?