Just set firewall policy to allow new / existing connections from your trusted machine to your untrusted ones and only existing connections from your untrusted machines to your trusted one.

Granted, an average user will not be able to figure out how to do this and a standard private VLAN guest network is going to prevent this from working.