Old post but gonna answer it anyhow, so that it has an answer.
In terms of WiFi, VLANs could be configured as such that anyone on the same VLAN will be able to see each other and share files, etc. (assuming that wireless isolation is NOT enabled), but no one on differing VLANs would be able to see each other. Using strictly VLANs for complete isolation, you would have to create a new VLAN for each WiFi client and also make sure each client has their PC tag packets as belonging to their assigned VLAN. It is also possible to assign a different SSID per VLAN (depending on equipment abilities) and give a different SSID per client, as opposed to using tags. Using strictly only VLANs may not be desirable for your goal as it would require more management and would very likely hit a VLAN quantity cap before the max number of clients the device can handle is reached.
Wireless isolation is a function that simply keeps ALL members on any SSID, for which the isolation is activated, from seeing each other or sharing files. However, this function does not necessarily prevent any particular WiFi client from accessing the management interface.
To achieve your goal, it appears that you want to make two VLANs. One VLAN is for device management only, which involves assigning the management interface to respond only to requests on that VLAN. The other VLAN is for clients only and would also have wireless isolation enabled on it. If your device allows the creation of multiple SSIDs (with their own passwords), you could assign each VLAN to its own SSID--that would keep clients out of the management interface. Wireless isolation would keep clients from talking to each other. This solution is possible to achieve with only a single wireless device, which could supply an Internet gateway to all VLANs it controls.
