How do I make it so that only port 80 and 443 can be used though my hotspot?
should be like this
/ip firewall filter add chain=input dst-address=!10.1.1.1/32 dst-port=!80 action=drop
/ip firewall filter add chain=input dst-address=!10.1.1.1/32 dst-port=!443 action=drop
10.1.1.1 is the router ip so you can allow yourself to connect to the router without hassle
Through his hotspot.
Should that not be forwarding chain??? 
Then port 443 wil get droped before it gets to the second rule.
It should be:
port=80 action=accept
port=443 action=accept
anything else action=drop