Asus RT-AC68U, block devices behind WAN

[fabio_]

Hello,

Not very experienced on network things so I'm seeking help.

I have following setup:
-Asus RT-AC68U (Merlin)
-Arris TG2492S (cable modem + 4 port router, control partly restricted by ISP provided).
-Two home automation devices (LAN only, no wifi so I cannot utilize Asus guest network capability) which I don't trust which I want to isolate from intra, but they need to connect to internet.
-Bunch of trusted devices (PCs, NAS, PS, etc.).

Topology now:
Asus (firewall on) [WAN port] <---> [Ethernet] Arris (firewall on) [Cable] <---> Internet

I have connected all trusted devices to Asus (better router of these two).
I have connected the two untrusted devices to Arris via LAN.

Question#1: how do I make sure that devices connected to Arris don't get access to devices connected to Asus (I don't need to access them directly via devices in Asus either)? I can configure Asus but I cannot configure Arris (that much).
Question#2: Better suggestions (e.g. how to setup VLAN for ethernet ports in Asus?) I would bit dislike this, but with good instruction doable.

Thank you in advance

 

[ColinTaylor]

You don't need to do anything. The firewall on the Asus will block all unsolicited incoming traffic by default.