How to separate wifi users with Sophos APs connected in a mesh network without manual intervention

If you are reading this thread, probably because you are having the same issue/limitation I have. The goal is to find a way to separare Wi-Fi users on different SSID when Sophos APx are connected through a mesh network on XG. 

• Option 1: Separate zone: while everything works from the AP side, wi-fi users will find surfing very slow or not surfing at all. Indeed the Sophos KB: https://doc.sophos.com/nsg/sophos-firewall/18.5/help/en-us/webhelp/onlinehelp/AdministratorHelp/Wireless/WirelessNetworks/index.html requests you to lower MTU settngs on end point devices. Well, how can you do this when the guest network is used by mobile devices? No chance. 
• Option 2: Bridge to VLAN: this does not work either. Based on this article: https://doc.sophos.com/nsg/sophos-firewall/18.5/help/en-us/webhelp/onlinehelp/AdministratorHelp/Wireless/MeshNetworks/index.html#things-to-know-about-mesh-networks you cannot use mesh and Bridge to VLAN settings. Indeed, I tested and only the cable connected AP gets the correct IP address in the correct VLAN, while the other 2 AP (I tried with APX 320), will lose the correct IP, once you move them from the cable to mesh. I created all the settings and at the end the mesh networks. By connecting each APX to get the configuration, all of them received the correct IP address, but once I moved them to not cable connection, APX get the ip of the physical port where the VLAN are created. I also tried to disable the DHCP on the physical port. Well, the APX won't get the IP at all. 
• Option 3: Bridge to LAN: this is the only settings that works with mesh network. The limitation here are 2: firewall rules: the only way to filter guests devices to internal wi-fi devices is to use DHCP reservation and firewall rules attached to mac-addresses or to an IP range. So, here you need to inventory all devices and create a dhcp reservation. There are no ways to allow devices that connects to one SSID to have different rules and settings than other SSID. The main problem of this (in addition to manual creating dhcp reservation) is, i.e example, if an internal user needs less restricted internet surfing (because the internal SSID is more restrictive), the user can connect on the Guest SSID (which is not restrictive at all), but because the DHCP reservation comes in, the user will always match the more restrictive fw rule. The other main problem is reporting: image you need to investigate who did the bad things using the same IP addresses for both guest and internal users. 

There are no other options or workaround at the moment. Please Sophos make sure you can fix option 1 (MTU settings) and option 2 (by allowing mesh APX to get the right IP address). 

Regards