I am also noob in this context and haven't got my head around things yet, so the exact mechanics of things I cannot answer...
Anyway.. from what I've gathered, NAT is the concept that allows inside (LAN) interfaces to communicate on the WAN (internet) port. Take a look at: (same video, first with config through CLI, the other through the gui)
https://www.youtube.com/watch?v=HutPDlX0XLY
https://www.youtube.com/watch?v=0670sbPD8b0
To prevent some VLANs to access the internet, I guess you need to accomplish that with firewall rules.
I'll leave it at this, hoping someone with better understanding and knowledge can shed more light on the matter. :-)
