Thank you. I have watched the video. It shows how to enable WiFi and create a WiFi password. All this is set correctly. Wifi is enabled for both bands. The Wifi signal is present, but it does not carry internet. I understand that a WiFi router may have a radio signal but no internet when the IP settings for the source (modem or other router) are not correct. But for what I know, these settings are not different for the guest WiFi, so for logic, either both can connect or neither can. This is the crux.

  @terziyski, as I mentioned in my last post, I know now what I should do: set up rules for this router that prevent devices connected to it from having access to the secondary router (ER605, the one between the modem and the primary router).
What I don't know is HOW to do it.

Can you help?

To explain the setup:

I have two modems from 2 different IPs. They are connected to two WAN ports of a TP-Link ER605 (Gateway 192.168.0.1).
One of the ER 605's LAN ports is connected to the WAN port of the TP-Link C1200 (Gateway 192.168.1.1), which provides a WiFi connection for our private use (regular and guest WiFi). My main PC is also connected to one of the C1200's LAN ports via an Ethernet cable.

Another LAN port is connected to an 8-port POE switch that connects to several POE access points in our small hotel. These APs are set to have a static IP so they can be identified in the network.

There, we have had similar problems to the one I described initially, i.e. some of the access points allow us to connect to their WiFi but there is no internet connection.

It is now clear to me that this problem has the same cause as my initial WiFi problem at the C1200, i.e. conflict of subnets, because these APs can connect to either the primary or the secondary router.

I suppose that I need to modify something in NAT Forwarding, but what?

The ALG settings are all enabled.

No Virtual servers, Port Triggering, or DMZ are defined.

I appreciate your input.