How to isolate traffic on Mikrotik ports?

Question

network hardware

The task is as follows:
There is a mikrotik rb750g
1 port van
2 port subnet 192.168.10.0/24 - the enterprise network.
Port 3, subnet 192.168.11.0/24 - a public network, well, let's say a hotspot.
It is necessary that one subnet does not see another.
Now there are two dhcp on different ports, without master ports and bridges, but for some reason the ping passes.

Answer 1

in the firewall, disable forward from 192.168.11.0/24 to 192.168.10.0/24