As I understand it, your desire is to setup two local IP subnets, one for child's gaming activity (let's call it "gaming subnet") and another for everything else (let's call it "main subnet"), with both subnets sharing a NAT gateway to single WAN connection. Plus, you'd like to setup separate WiFi network for each, and you'd like to allow access from the main subnet to the gaming subnet, but not vis versa. And, I'll bet you may want to limit the WAN throughput on the child's gaming subnet (if not now, then someday).
I've setup similar configurations with multiple semi-isolated LANs using a single SOHO-grade firewall/router. So it can definitely be done, but I'm 95% sure the stock firmware provided with AC68U or AC66U is NOT capable of this type of direct (one-layer) multiple LAN subnet configuration. I believe I tried something similar using VLAN with Merlin firmware branch in past without much luck on an older RT-N66U, but that could just be my mistake and hopefully someone with more knowledge on Merlin's firmware branch can chime in. I believe Open-WRT is capable of such a multiple LAN subnet config using internal VLANs, firewall zones, and NAT routing features, but I also recall that Open-WRT alternate firmware doesn't have support for your Asus RT-ACxxx devices because they are Broadcom chipset based.
Three options for you to consider:
1. Purchase or build a more capable firewall/router that you connect to your WAN, and setup two semi-isolated LANs as desired. Then you can re-use your existing two RT-AC6xU in Access Point(AP) mode hardwired to the new firewall to setup the independent WiFi networks for each subnet. The basic config is you setup two LAN IP subnets with each associated with one or more physical ethernet LAN ports, then each sub-network has DCHP plus NAT routing enabled to a single WAN port, finally a firewall rule allows one way traffic from main subnet to gaming subnet.
To build firewall yourself, you could use an older computer with three wired Ethernet ports and the popular free Pfsense software-based firewall, or they also sell dedicated Pfsense enabled hardware ($180 and up). I personally use Zyxel USG40 firewall ($250 to $350) for small office with multiple LANs, but might be more complex than you want, and about 50% higher cost than Pfsense basic hardware. Many other similar dedicated firewall options available, but many are significantly more expensive.
2. You could try to leverage the "Guest WiFi network" feature of your best existing WiFi home NAT router, and turn on "Guests can not communicate with LAN (Intranet)" blocking feature of Guest WiFi. In this setup, the Guest network is used only for the gaming network and router is isolating the guest network. Disadvantages include you can only have Guest Wifi, not Guest wired LAN ports, with stock firmware (perhaps Merlin's firmware support's more flexible Guest network setup with physical ports too?). Also you won't be able RDP to child's computer from main subnet because isolation between regular LAN and Guest Wifi is both directions. Some routers always use "client isolation" within the guest network (some have a enable/disable config option) that would prevent you from connecting to the Guest Wifi and RDP into child's gaming computer even over the Guest Wifi. However, I think Guest Wifi network is the best option (easy to manage) with your current hardware if you could give up the remote access to child's gaming computer. Asus Guest Wifi doesn't use separate IP subnets, but rather sets up a virtual barrier between two parts of the same subnet. On my newer RT-AC86U, I can also set bandwidth limits on the Guest Wifi, and have up to three separate Guest Wifi SSIDs.
3. Finally, you could setup a two-level network, which is what you've been exploring so far with your outer router1 and inner router2 topology. I think you'll find with your first attempt having the gaming subnet on router2 (inner RT-AC66U), that the gaming computer(s) can still communicate to your main subnet computers (e.g., try pinging your main computer from gaming computer by IP address), unless you do
@ColinTaylor suggesting of filtering the outer main subnet IP address on the inner router2 network services outbound firewall rules. If you try that, then I'm pretty sure router2 DOES need NAT routing enabled, because it's inner LAN is going to be an isolated subnet. In just AP mode (no NAT) you won't have the outbound firewall available. I don't think either RT-AC6xU supports a pure router mode with stock firmware, and even that would require the outer router to support two IP subnets (hence #1 above uses a new firewall/router). With normal NAT routing on router2, the inner gaming subnet is going through two-NAT router layers and that won't work for many peer-to-peer gaming setups.
A better topology for #3 option is to reverse the inner/outer subnet associations by configuring the gaming subnet as the outer/top-level LAN (and WiFi) off your RT-AC68U (in normal NAT mode) router1 that has the connection to ISP, and then your "main subnet" is the inner/second layer (more protected) subnet off the router2 LAN ports with its WiFi. The KEY to the inner/outer config is that router2's WAN port is connected to one of router1's LAN ports (no need for the dual-WAN setup on router2 with lan-to-lan wire). The inner-network's NAT router2's default firewall would prevent the outer gaming network devices traffic into the main (inner) subnet. But router2's outbound NAT routing still allows traffic initiated from the inner main subnet to the outer gaming subnet for your RDP connection. In this topology, the outer gaming subnet only has one-layer of NAT and all gaming subnet applications (including UPnP for port forwarding) should work same what you started with. However, two-level NAT on the inner main subnet is not good for some applications (VoIP, anything that is peer-peer, etc.) that might be on the main subnet, and if you needed any open inbound ports from the Internet to the main subnet, it will be harder to setup (two layers of port forwarding required) and UPnP can not function to automatically setup port forwarding to main subnet (although I'd avoid UPnP anyway).
Good Luck. If this isn't clear yet, we should draw some diagrams next.
