RaspAP: Block Lan access for AP Clients not possible

[redschumi]

I am running a RaspAP (pi zero w2) in wifi client AP mode. Works perfectly.
I would like to run this AP as an IoT only AP.
Unfortunately, it is now so that a client on the AP in addition to the Internet can also reach my internal clients via the IP address. I would like to prevent this. Can someone help me with this?

[billz]

RaspAP does not arbitrarily impose any firewall rules, apart from what is minimally needed for AP functionality (NAT).
How are your AP clients connecting to your internal subnet? via SSH?