@JessieG, when using FaecBook authentication, access to the FB servers must be granted, else a FB page could not be shown as the portal page. That's why other clients using a different SSID inside the same network cann access the FB page, too. The most easy way to prevent this would be to have the portal page server (that's FB in case of FB authentication) either to reject or to serve all requests coming from different SSIDs.

Special policies such as »30 minutes free access, then FB authentication« can be implemented using an External Portal, which gives any freedom to implement whatever auth method, but even then it would require to store every client which already did consume the 30 minutes test period forever (or at least for a very long time). You would need pretty fast servers to check a growing database on each login for clients which have already consumed their 30 minutes free period, otherwise login processing will become very slow over time.

For example, Amazon has implemented such a scheme with their Prime test period of 30 days. They have huge processing capabilities at their disposal. FaceBook could do this also, but definitively an OC200 can't do so.

JessieG wrote

I was hoping there is a way so that only the specific SSID have access to facebook like vlan or rule config that can isolate the SSID and its clients?

Only TP-Link can give a definitive statement about this, but I just wanted to point out the in firewall rules it is not possibe to specify rules depending on the SSID. It is indeed possible to specify firewall rules depending on the VLAN, resp. its interface. Indeed the SSID can be evaluated by the portal software (that's FaceBook for FB auth).