Adding Phone subnet to OPNsense

[dcol]

Hi all,
I want to add WiFi phones that are getting their IP via DHCP on the Access Point via a predefined separate IP 192.168.3.1/24. This AP also has WiFi connected computers on a separate network which is the LAN subnet on OPNsense (192.168.1.1/24). I am doing this because the phones require DHCP option 160 and I want them isolated from the LAN.
The phones only need Internet access and never need to bridge to the LAN, obviously.
Should I use a Virtual IP setup? If so, are there any guides?
I suppose I could just add another AP, but then I would lose the advantage of the AP mesh that is setup around the building.

What is the best way to go about this so the phones can access the internet but not the LAN from the same OPNsense firewall.
Thanking all in advance.

[Amr]

by WiFi phones you mean VOIP phones right?
Well VLAN is the way to go, but if it's not an option (you don't have a VLAN capable switch or your AP don't support VLAN -consider buying a used one?- and you don't plug the AP directly into opnsense), you could try installing openwrt on your hardware and using a guest wifi instead (also check if your AP supports guest networks) but I'm not sure if that will work.