managing different firewall rules on same captive portal

[Giampiero]

hi, first time posting on this forum, hope i'm doing it right

i've just installed opnsense, and i intend to use it to manage my office WiFi.
I'd like to arrive in a situation where office's guest can log in the  wifi using a voucher, only beeing able to navigate internet, without seeing the rest of the Network. I would also like the employes to log in with a normal user, and be able to navigate the LAN. using more than 1 antenna unfortunatelly is not an option...

i've already set up a captive portal following the OpnSense tutorial, but not beeing experinced enough with the tool, i wasn't able to find a solution.

hope that you guys can help me.

thank you very much