First of all, you don't use NAT between private subnets. You only use NAT when it is required, most prominently between private and public subnets.
If you do use (source) NAT, you can't filter in the destination subnet because all you see is the NATed router's IP address.
The syntax for basic ACLs is
permit|deny <sourcesubnet> <sourcewildcard> &...
Since you want to permit WAN traffic, matching only any, you need to have a permit any any at the end.
Basically, you want to deny traffic in and out of the Wi-Fi VLAN. For each of the other VLANs you need a
deny ip 10.0.240.0 0.0.0.255 <otherSubnet> <subnetWildcard>
on the incoming interface or the VLAN of the wireless subnet and
deny ip <...