creating groups with different internet access restrictions

Im planning to create groups using my mikrotik router,example, admin groups,can acces any websites and theres no limit in bandwith, “employee” group has limited access in some websites, “guest” group, minimal access to internet, something like that..im thinking of hotspot as an option but I can only modify bandwidth and theres no option to block file extensions. please tell me what should I do.