What we need to do is to provide a customer with two individual SSIDs, office and guest and we need the guests to not be able to access anything other than the internet.

The AP900s will be set up as basic access points connected to the switch.

The option to isolate members and isolate lan seems perfect, yet the latter isnt permitted on AP mode.

I dont really see the point of isolate LAN if it cant be enabled in AP Mode, anyone know why this is or whether it can be configured like this?

To truly separate the traffic it would be best to set up VLANs and use 802.1q tags the on the gateway set up access lists.