any suggestion about seperate wifi access to local network

I want wifi network to be seperated from local network.

But all the AP is on the switch that connected to the fortigate port operate as soft switch.

So far i tried group device from source device and source port from internal to server's address.

But still i can access the server.

***All AP does not support vlan.