Create rule before Default allow LAN to any rule.
Action > Block LAN > in Protocol > any Source > Single host > Device IP/32 Destination > Invert > LAN address
Create rule before Default allow LAN to any rule.
Action > Block LAN > in Protocol > any Source > Single host > Device IP/32 Destination > Invert > LAN address