To anyone else who happens to stumble across this page in the future, this solution comes from member "afraIT".
I had originally set my NANO on "Allow" mode (for both options) when doing the initial setup. This turned out to be wrong and would cause the client to not be able to reach the internet once connected.
Preform a factory reset and choose "Deny" mode for both options instead of "Allow". (Fill in everything else as you normally would)
I then connected to my NANO via the website, then connected the NANO to my internet (Networking page - WiFi Client Mode)
Next, I did a brief Recon scan, added the "Scan Results" (there's a nice little drop-down arrow "Add all SSID's to PineAP Pool"), went to PineAP, checked all the boxes, enabled both options and saved the settings.
Lastly, I used my iPhone to search for the local WiFi. Connected my iPhone to my NANO's AP successfully and was able to reach Google 🙂 (I also tried connecting this way with a Android as well; works)