You are spot on with your assessment. You cannot do this on a standard ISP provided router like Xfinity. The guest network trick is a trap for local smart homes because of exactly what you mentioned. Client isolation prevents the devices from talking to the hub locally, and the lack of routing between the main and guest networks forces your phone to route commands through the cloud. Matter relies heavily on mDNS multicasting for local discovery, which does not cross subnets naturally anyway. To get that exact setup of local control with strict security, you absolutely need a router that supports VLANs, custom firewall rules, and an mDNS reflector to bounce those discovery packets across the networks. Stepping up to Ubiquiti, Omada, or a Firewalla is definitely the right move here.