I’ve found way how to disconnect all wireless clients from MK just with read-only access via winbox.
When a go to Wireless, detail of an interface and then Scan or Freq. usage, wireless card go to sniffer mode and all the clients are disconnected I dont even need write access
Should this be a default setting, though, for the read user group? Seems to me that you would want this group to have no rights to do this kind of thing. Perhaps this should be changed in the default settings.