To be able to block clients from a hotspot (so they don't even get an Ip address) it would be useful to
have address-lists that store mac-addresses. Then one could set up a 3-stage set of lists like the SSH bruteforce recipe

Yes, would be useful.

Would be useful with bridge firewall too .

+1 for mac-address-list in bridge filter/nat and mac-address-list along with ip firewall rule src-mac-address matcher

+1 for mac-address-list in bridge filter/nat and mac-address-list along with ip firewall rule src-mac-address matcher

and f course add-src-mac-to-list and add dst-mac-to-list (and hopefully also remove-src/dst-mac-from-list...

++1