Problem here is that since all your clients are on the same broadcast domain they won’t communicate via ZS, so these firewall rules are useless. You need to force your clients to communicate via ZS, which could mean setting for every wireless client a /30 subnet, so that they have to pass via ZS to communicate with other clients.