MikroTik

I am setting up a RB493AH with a public and private network and need to isolate them. I have eth1 as WAN. Eth2 through eth5 are bridged as "guest network" while eth6 through eth9 are bridged as "office network". How do I ensure no one on the guest network can see the office.

Here another challenge I face. Eth9 goes to a wireless point to point and needs to have both quest and office access. Is this possible in the RB493? Any help would be greatly appreciated.