The LAN, Guest, and IoT are different bridge interfaces, so they are naturally isolated from each other at Layer 2.
The firewall provides Layer 3 isolation between them.
In addition, Guest and IoT networks are intended for Wi-Fi use by default. When AP Isolation is enabled, Wi-Fi devices within those networks will also be isolated from each other at Layer 2.