EX5601-T0 separate LAN

Hilltophouse

Hi, using EX5601-T0

It has an "Interface Grouping" option which by reading seems to do what I want…."Each group acts as an independent network on the Zyxel Device. Devices in different groups cannot communicate with each other directly."

However when I create a new Group for LAN4 port, plug in a device it can still communicate with other devices connect via other LAN ports or Wifi. Anything plugged into LAN4 gets a different IP range in 192.168.2.x rather than the default 192.168.1.x but even though different pings still reply.

I want anything plugged into LAN4 to be fully isolated from all other devices and only have access to the Internet.

Please can somebody advise on how to restrict.

Many thanks