Easy, if the wireless interface is part of a bridge then take it out and make it it's own interface. Then create a firewall rule on the wireless interface to allow any to any, then above that create a deny rule for any to the LAN subnet. Now it will be able to access the internet but won't be able to access the LAN. If you want to allow some access just add more rules above the deny rule.