Device isolation exclusions failing on Cambium APs

I have a network with an bunch of Cambium cnPilot e410 APs controlled by the cnMaestro cloud controller. They are running version 4.2.1-r12.

We have 2 wlans set up, 1 for internal use, and one for Guest access. The guest access wlan has client isolation turned on and set to Network Wide. It is also on its own vlan.

We need to allow a couple of wireless printers on the guest wlan. I added their MAC addresses to the client isolation list but they are still not accessible on that wlan. I have made sure they are on the correct wlan and connected. They do both show an IP address and gateway address that is correct for that wlan. I'm not sure what I'm doing wrong here.

For troubleshooting, I turned off client isolation and the printers were immediately available. They are also available from the internal wlan almost any time. Turning the isolation back on, the printers are once again inaccessible. Am I missing something?