Firewall - How to block one DHCP host from talking to Internet

[thereaper]

I have an WiFi access point (AP) attached to OPNsense machine via ethernet.
AP gets its IP via OPNsense DHCP. AP's own DHCP server is disabled.
I want to prevent AP firmware phoning home to TP-Link.

What is the proper way to configure this in Firewall? How can I specify a DHCP lease (MAC address?) as a source in firewall rule?
OPNsense 20.7.5-amd64

[lfirewall1243]

I have an WiFi access point (AP) attached to OPNsense machine via ethernet.
AP gets its IP via OPNsense DHCP. AP's own DHCP server is disabled.
I want to prevent AP firmware phoning home to TP-Link.

What is the proper way to configure this in Firewall? How can I specify a DHCP lease (MAC address?) as a source in firewall rule?
OPNsense 20.7.5-amd64

Give the AP a static lease and block it then