I’m sure on the firewall page you should be able to change one of the settings to disallow from others on the local network.
Maybe if Wan to Lan input is reject instead of accept, return packet from NAT would still make it through. but nothing else.
Maybe I’ll do a port scan on my host network 192.168.0.1 to see if anything is open in that configurtaion.