1. First of all, you will need to create a separate LAN interface with a separate DHCP server in it. You can do that by navigating to VLAN > LAN Networks and creating a new subnet: 192.168.2.1 and DHCP server for 192.168.2.x.
2. Make sure you have a wireless access point enabled.
3. Go to CLI, login and execute cd /etc/config and vi network
Click the letter "I" on your keyboard so you could start editing the file.
Find your new created LAN interface and change it to look something like that:
To exit editing mode press "ESC" on your keyboard and write :wq to save and exit from editing mode.
4. Now edit file wireless with command vi wireless in the same folder.
Once again click letter "I" on your keyboard to start editing the file.
Find your AP in the file and edit it's network to your new created LAN name, it should look something like that:
Press "ESC" button to exit editing and type :wq to save and quit.
Execute command /etc/init.d/network restart so your router could restart network service and apply changes.
After this check if your wireless client is getting IP in your new 192.168.2.x subnet.
If everything works till this point please proceed with the next step where we separate LAN from new wireless LAN.
5. Go to Network > Firewall > Traffic rules
Scroll down and create a new forward rule, which source is your new LAN interface and destination is the main LAN.
When you're in rule edit page make sure source and destination zones are right, scroll down to the bottom and select action as "drop". Save.
Create one more rule which has the same source and destination zones but select "reject" this time.
Once you're done with these two rules create two more, but this time with source and destination zones swapped so main LAN cannot reach your new LAN interface. (this is optional so if you want main LAN clients to reach your new interface you can skip this).
6. After this wireless clients shouldn't be able to ping your internal LAN network behind 192.168.1.x subnet.