restrict lan access

Hi I am not sure what the best way to go about this is but I have a device that I would like to have internet but not have access to other devices on my LAN. I am using to run Ubuntu on a pi for a wi-fi hotspot. I would like to limit the pi IP Address to only be able to access internet. Is...

I have an Asus AC5300 as primary router, gateway and DHCP server and an AC66U as a secondary AP. On the AC66U I have created a Wifi Guest Network that I don't want to access my LAN. Only the AC5300 for internet access and a single Chromecast. I get this to work when using stock firmware...