I have a ZoneDirector with the following settings: type Standard Usage, Open Authentication and WPA2/AES encriytion options.
How I can make clients connected to this WLAN can not access the configuration ZoneDirector and APs?
Slightly off the wall suggestion: Using different subnet for APs from rest of your network.
Use ZD DHCP option and specify seperate IP subnet so that the clients get IPs on different address range from APs.
Seems a bit hammer to crack nut plus possible side-effects depending your specific environment. Needs thinking through before doing.
Bigger brains than mine might be able to suggest a neater workaround.
Failing that make sure your ZD password is very secure (which it should be anyway). Reiterating Keiths' first suggestion.