The way we keep the separate SSIDs working is to use VLANs, each VLAN has its own subnet and inter VLAN router is customised depending on the customer requirements. This rule succeeds to block the Wi-Fi from accessing the customers backup LTE as the Source network matches the VLANs subnet assigned to the Guest Wi-Fi
You may like to have a look at this previous thread
Also there is a guide here that may be useful
If you are still having issues, PM us your contact details and supplier, we will help get this sorted for you with the local team.
Happy to Help,
Marcus