@Dropbear 

It can only be done by a switch ACL.

  @Dropbear 

Yes, add the Permit rule first, then the Deny rule. BTW you need an Omda switch to make the switch ACL work.

  @Somnus Im really confused now .... it appears that the GATEWAY ACLs are the only ACLs that support stateful rules..

I block CAM Vlan from talking to my LAN vlan... however my LAN vlan can talk to my CAM vlan and the CAM vlan can reply (as Im using a stateful ACL rule via GATEWAY ACLs).

So you're saying I need to give this up just to support my poking a new hole for a single instance where I need the CAM to be able to instigate a connection to a single port on a single IP on a LAN vlan?

  @Dropbear 

You are right.. I thought the switch also can do stateful ACL but when I check the controller page only the gateway can do that...

But on the switch, you can still do the ACL. So Permit rule first, to allow the specified device communicate with main LAN; Then Deny rule, to block all other traffic. See the example:

Here the "IP Group TEST" contains the specified device's IP(in your IOT network); "Network Guest" can be seen as your IOT network.

These rules mean the switch will allow "IP Group TEST" communicate with main LAN, however block other data traffic between these two network.