Mikrotik how to prevent users from wlan from accessing ether?

Question

Mikrotik

I set up Mikrotik SXT Lite2 equipment Ether1
interface - (wan) looks into the corporate network, it also receives direct Internet.
The wlan interface - dhcp server distributes by waffle.
vpn interface - all wifi client traffic is allowed through it
Question - how to prevent wifi users from accessing the corporate network, but only access to the Internet

Answer 1

Two vlans between a Mikrotik with a wafer and a Mikrotik-gateway; one for management, the second for the guest network.
My mikrotik gateway is responsible for distributing addresses for the guest network; Mikrotik distributing Wi-Fi does not have a vlan interface for the guest network at all and, accordingly, does not interact with it in any way. So fewer entities arise =) And on the gateway it is already being destroyed by the firewall.
To simplify the task, read about bridge-vlan.