Forcing Echo devices to stay put on an IoT access point

I have a Firewalla Gold SE configured in Router Mode between a Spectrum modem connected to port 4 and two separate access points with two different network IP addresses. One AP is a Linksys MX4200 tri band mesh system configured in bridge mode connected to port 3 with IP addresses of 192.168.1.xxx/24 for my main LAN. FYI, the Linksys disables MAC filtering when set to bridge mode. The other access point is a TP Link TL-WA801N 2.4 ghz Router configured as an AP for my IoT LAN. All device IP addresses on either port are assigned by the Firewalla. I am trying to move all my IoT devices to the TPLink. Most everything has moved successfully except my Amazon Echo devices which when set to the TPLink SSID they end up back on the Linksys SSID the next day or so. I am trying to write a rule to prevent the Echo devices from being able to get an IP address from the Linksys AP thus forcing them to the TP Link AP. I put the Echos in a group and tried to create a rule that would block the group from internet access from the Main LAN which in theory would cause the Echos to go to the TP Link where they would have internet access. In the rule, I can set a target of "no internet" and select the device "Echo group" but there is no option to target the rule "no internet" for the Main LAN only. Seems like there is a button missing from the New Rule window.