How to create iptables rules for staff and guest ssid?

I have 3 SSID. staff, guest and dmz networks.
I have created br0(192.168.1.51) Mapped to staff ssid.
br1(2.1.1.1) mapped to Guest ssid.
Firewall is 192.168.1.1 connected to LAN port.
The objective is:
1)Staff SSID (br0) has access to everything
2)Guest SSID (br1) cannot access Staff SSID (192.168.1.0/24), but ONLY can access to Internet
3)Another newly created DMZ SSID (br3-3.1.1.x/24) ONLY can access Staff networks (192.168.1.0/24), but CANNOT access Internet
How can I set the iptables rules? Anyone familiar with the firewall rules?