Thanks, this is where I am at the moment:
1) I have a wired network on my RUT240 handing out IP Addresses in the 192.168.1.0/24 address space. Devices connected to this network can access the internet via the WAN interface which is a mobile SIM
2) I have a WiFi interface which is connect to a new VLAN. This VLAN is configured to provide IP addresses in the 10.139.128.0/24 address space. Devices that connect to this network get an IP address, but *CANNOT* access the internet.
3) Devices connected to the WiFi *CAN* access 192.168.1.0/24
I want to ensure that wired devices and WiFi devices can access the internet, however I *DO NOT* want WiFi-connected devices (10.139.128.0/24) to be able to see devices on the wired network (192.168.1.0/24)
The second thread you've linked me to is a lot closer to my desired configuration, however having checked my setup I appear to have followed the instructions anyway, I just can't access the internet from the WiFi devices.
My VLAN setup looks like this: