The 5009 should be connected to the MODEM
The HAP should be connected to the 5009
The HAP should be ideally or most simply setup as an AP/Switch with no dhcp responsibilites ( done on 5009 )
your best tutorial on this is: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
when planning the network ensure you have a diagram it will help.
-identify all users/devices (external/internal including admin)
-identify all the traffic required.