Here is how you can do it.
Create a rule in Switch Rule menu like this:
copy-to-cpu=no redirect-to-cpu=no mirror=no new-dst-ports=sfp-sfpplus1
What this does is that it redirects all traffic from the users ports to the uplink port (the one going towards Internet).
That way users traffic can only go to the Internet, and not to each others.
This rule also disabels loop-protect on the lan ports, as the loop-protect packet also gets redirected to uplink, so if you need this feature, then add this before the above rule.
mac-protocol=loop-protect copy-to-cpu=no redirect-to-cpu=no mirror=no
Hope that helps.