IoT Isolation SRK60

Seems like we only have an all or nothing choice:

"Allow IoT devices to see each other and access my local network"

If I allow this then the whole purpose of the seperate SSID for IoT is lost. I want the IoT devices to see each other, but NOT access my local network. Specifically I have a Hubitat hub which needs to talk to two Android tablets, two Konnected boards and some TVs. They are all on the same SSID, and I would like them to stay removed from my local network. 

Seems the newer WiFi 6 router allows this to be configured via VLAN. Personally I'd prefer a method whereby access levels could be granted on a device by device basis.

Thank you