Page 30 in the manual same as the wired WAN but uses wifi.
There is only one route so that is already a restriction.
In WAN connection settings see routing mode on page 26 of manual.
Default is NAT routing mode where inbound connection attempts to the WAN are dropped unless a LAN side device has initiate communication first. IP forwarding is where all traffic arrives and is routed onwards (limited only by firewall rules).
The SOHO adds internal routes dynamically for locally attached networks. There is no need for static routes between VLANS.
You need to get over your fear of enabling inter VLAN routing. When you disable inter vlan routing the SOHO adds a deny all firewall rule. Enable inter VLAN routing add a deny all to all rule and you have the same thing but then also have the ability to open up specific traffic flows if you want by layering firewall rules.