If your question is how to do it using WLC then you can apply Access Control List, under Security then Access Control Lists.
I have attached an example, see attachment.
If DHCP/DNS is in the internal network then you need to add it before blocking the private ipv4 addresses before Line 5.
Then go to WLAN, Select the SSID, Advanced, Override Interface ACL, IPv4.
If your question is how to do it in ASA, I guess post this inquiry under Security instead.
Please rate helpful posts.