Creating a Guest WiFi interface on Banana Pi, where devices on other interfaces can't reach each other

I have a Banana Pi I'm trying to use for a Guest WiFi network;

What I'm trying to achieve:

Pi forwards traffic eth0<->wlan0

Desktop can't contact Guest1, and the other way around.

Guest1 can't contact Pi on either IP, other than forwarding traffic through it.

(Preferred, but not necessary) Guests can't contact each other

I'm using:

udhcpd - for dhcp on wlan0

hostapd - for wlan0 AP

    Local network: 192.168.0.0/16
    Guest network: 1.0.0.0/24
    Router: 192.168.0.1

    Interfaces: eth0 - 192.168.0.0/24
                            wlan0 - 1.0.0.0/24

    Devices:
        Pi eth0     192.168.3.14
        Pi wlan0    1.0.0.1

        Desktop eth0        192.168.1.12
        Guest1  wlan0       1.0.0.105

I've tried these iptables rules but to no avail:

    -A INPUT -i wlan0 -p udp -m udp --sport 67:68 --dport 67:68 -j ACCEPT
    -A INPUT -s 1.0.0.0/24 -i eth0 -j DROP
    -A INPUT -s 192.168.0.0/16 -i wlan0 -j DROP
    -A INPUT -s 1.0.0.0/24 -i eth0 -j DROP
    -A INPUT -s 192.168.0.0/16 -i wlan0 -j DROP
    -A INPUT -s 192.168.0.1/32 -i wlan0 -j ACCEPT
    -A INPUT -s 192.168.0.0/16 -i wlan0 -p tcp -m tcp --dport 1:65535 -j DROP
    -A INPUT -s 192.168.0.0/16 -i wlan0 -p udp -m udp --dport 1:65535 -j DROP
    -A INPUT -s 1.0.0.0/24 -i wlan0 -p tcp -m tcp --dport 1:65535 -j DROP
    -A INPUT -s 1.0.0.0/24 -i wlan0 -p udp -m udp --dport 1:65535 -j DROP
    -A INPUT -i wlan0 -j DROP
    -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A FORWARD -s 1.0.0.0/24 -d 192.168.0.1/32 -i wlan0 -o eth0 -j ACCEPT
    -A FORWARD -s 192.168.0.1/32 -d 1.0.0.0/24 -i eth0 -o wlan0 -j ACCEPT
    -A FORWARD -s 192.168.0.0/16 -i eth0 -o wlan0 -j DROP
    -A FORWARD -s 1.0.0.0/24 -d 192.168.0.0/16 -i wlan0 -o eth0 -j DROP
    -A OUTPUT -s 1.0.0.0/24 -o eth0 -j DROP
    -A OUTPUT -s 192.168.0.0/16 -o wlan0 -j DROP
    -A OUTPUT -s 1.0.0.0/24 -o eth0 -j DROP
    -A OUTPUT -s 192.168.0.0/16 -o wlan0 -j DROP
    -A OUTPUT -s 192.168.0.0/16 -o wlan0 -p tcp -m tcp --dport 1:65535 -j DROP
    -A OUTPUT -s 192.168.0.0/16 -o wlan0 -p udp -m udp --dport 1:65535 -j DROP
    -A OUTPUT -s 1.0.0.0/24 -o wlan0 -p tcp -m tcp --dport 1:65535 -j DROP
    -A OUTPUT -s 1.0.0.0/24 -o wlan0 -p udp -m udp --dport 1:65535 -j DROP
    -A OUTPUT -o wlan0 -j DROP