Lockdown the satellites extended portion of an open guest wifi

A lot of this depends on the configuration of your office LAN, especially what kind of router and firewall you have and how DHCP settings are assigned. I suggest:

1) Configure the wifi hub as an access point and not as a router, and connect it to the LAN's router. Let the LAN's router manage its traffic.

2) Create a VLAN on the office network for the guest wifi network. You should have at least two VLANs, one for the guest wifi network and one for office devices.

3) Create a DHCP server for the VLAN to serve the guest wifi network. If possible, assign IP address reservations for the devices you want to allow to connect to devices on the office VLAN.

4) Route only the specific traffic you want to allow from the wifi VLAN to the LAN. You might be able to limit it by MAC address, but two-factor authentication may be the best option, since a properly configured mobile device spoofs its MAC address when it changes networks.

I hope this helps.