Disable Web GUI on OPT and/or LAN interfaces?

I have guests connecting to a DMZ on the OPT interface, and all works fine.

But...

These guests can connect to the web gui by surfing to their "gateway", and
if they manage to guess the userid/password they can change or reset my
setup.

Q: How can I restrict on what interface I want to allow the Web gui? I only
want the GUI accessible on the LAN interface...

Thanks,

Mikael