EdgeRouter Lite - 2 LAN routing and port forwarding

Hi!

On my edge router lite with v 1.9.0 I have 1 wan interface (Eth 0) and two lan interfaces:

Eth1 10.52.72.254/23 "intranet"
Eth2 172.16.51.126/25 "guests"

Both are connected to managed switch with configured VLAN for guest port.

In intranet I'm running UniFi controller in Synology Docker, reachable at 10.52.73.100.
In intranet there is also one UniFi Ac pro AP. It gets the intranet by standard and the guests lan by VLAN ID20.

Clients connecting to guests wifi get ip out of guests lan (172.16.51.xxx) and wifi clients on intranet wifi become address out of intranet (10.52.72.xxx). So far so good.

But now I've enabled the guest hotspot function. By this the guest wifi client (172.16.51.xxx/25) has to connect to UniFi controller (10.52.73.100/23).

There is no routing in moment. What must I do that the wifi client from guests can access the UniFi controller?
What must I set that the guest client can only access the port for UniFi hotspot portal and not the rest of my intranet and also the rest of 10.52.73.100?

Cannot find a running configuration.

Would be nice to get some tips. Many thanks for your support!!!

Best regards
Pascal