best way to isolate virtual APs

RouterOS Wireless Networking
2

Best way: VLANs combined with firewall rules.

The DE FACTO guide around here:
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1