Isolating wireless access from trusted network on Watchguard T35-W

I am testing a T35-W that we want to replace our existing Sonicwall TZ unit with. I've gotten pretty much everything else figured out but the built in wifi. While I had no problem getting Access Point 1 working within our trusted network as well as the internet, I am hitting a wall getting Access Point 2 configured for guests so as to block access to the trusted network while still giving it internet access. I enabled its DHCP server and assigned it an IP range on a different subnet than the wired trusted network. I left the default gateway setting as Use the interface IP Address. I created a policy that denies access from Guest Wifi to Trusted on all ports. In the end I am able to get internet access to work fine but I am unable to block it from the trusted network, even the IP to the Fireware login screen is still accessible. What am I missing?