So I learned the order of iptables rules matters and that solved my problem. Below are the commands I appended to my /etc/firewall.user file to block access to local subnets. The pineapple is still accessible though (possibly because it's the default gateway?).
#block all traffic to any possible private network address (10.*.*.*, 172.16-32.*.*, 192.168.*.*)
iptables -I FORWARD 1 -d 192.168.0.0/16 -j DROP
iptables -I FORWARD 1 -d 172.16.0.0/12 -j DROP
iptables -I FORWARD 1 -d 10.0.0.0/8 -j DROP
