Block Connection to Specific BSSID's?
Might be worth a shot to try this:

$IPTABLES -A "afwall-reject" -m mac --mac-source 00:00:00:00:00:00 -j DROP


the switches in iptables are case-sensitive. 

Replace 00:00:00:00:00:00 that with the MAC address of the BSSID that is transmitting wifi beacon packets, and password protect it to prevent mitigation attempts in trying to override it.