RUT241 : Restrict WLAN access to GSM

I am currently using a RUT241 to provide internet connectivity in a kiosk application to 2 Ethernet devices (with the WAN as LAN option set).
This use case has been working great, but now I want to use to allow a WiFi device to connect to one of my LAN devices, and prevent that WiFi device from access the internet.
I am a bit lost with the firewall and routing options, can anyone point me to the correct direction ?
Thanks !