Can you configure UniFi APs to broadcast multiple SSIDs on different VLANs so the 2 networks are fully isolated from each other?
E.g. SSID_1 on VLAN30 subnet 192.168.30.0/24. SSID_2 on VLAN40 subnet 192.168.40.0/24
I set up my VLANs in my switch (EdgeSwitch 24 Lite). Any fully VLAN capable switch should be able to do that. Just set the port the AP is connected to so that the untagged packets and any VLANs you want go to the AP. In the AP, set up each SSID as untagged, or tagged to one of the VLANs going to that port.
I run three SSIDs: Blue, Blue-guest and Blue-IoT. The same SSIDs are used on 2.4 GHz and 5 GHz. Blue gets the untagged packets from my Inner subnet where I only allow trusted devices. Blue-guest gets VLAN 2 packets from my Outer subnet where I put my guests and services for them. Blue-IoT gets VLAN 5 packets from my IoT subnet where untrusted devices go. I also set up my IoT SSID so that the devices are not allowed to talk directly to each other.
My router (EdgeRouter 4) has two ports connected to the switch, eth1 and eth 2. Eth2 sends untagged packets to the Inner subnet. The switch passes them on to all the other untagged ports that are on the Inner subnet. Eth1 sends untagged packets to the switch, where they get tagged at the switch port to the Outer subnet on VLAN 2. The IoT subnet on VLAN 5 shares the eth2 cable to the switch but with the packets tagged as VLAN 5, and they are left tagged and the switch passes them through as VLAN 5. My AP (Ubiquiti Flex HD) has only one Ethernet port, so it gets untagged Inner subnet packets, VLAN 2 tagged Outer subnet packets and VLAN 5 tagged IoT packets on the same cable.