Your approach is flawed, if you want to use the RB4011 solely as an ap/switch with one flat network then your approach is sound.
The RB4011 has a bridge with IP address set statically or assigned by the upstream router.
However now you want a guest network, and you suddenly want the RB4011 to act as a router.
The only option I would consider is move to vlans assuming you dont want guest wifi users to be able to reach the rest of the network subnet of the upstream router.
If you turn the RB4011 into a router, then you will have to sourcenat any subnets to the WANIP of the RB4011 to ensure return traffic works for example (or I suppose use dst-nat on the upstream router if MT).
What I would do is change the flat subnet existing into lets say vlan10 on the upstream router and and create vlan20 on the upstream router for guests.
On the upstream router attach vlans to bridge.
All bridge ports are access ports to vlan10 except for port to RB4011 which is a trunk port carrying vlans 10,20
On the RB4011, the bridge as on the upstream router has no dhcp responsiblities solely bridging.
The only vlan that needs to be identified as belonging to the bridge is vlan10 and the IP address of the RB4011 becomes one attached to vlan10.
On the RB4011 the etherports become access ports to vlan10 and the WLAN port for guests is access port for vlan20.
On the upstream router ensure forward chain firewall rules allow the traffic required for both vlans.
Best reference for vlans - http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Reference for ap/switch - https://forum.mikrotik.com/viewtopic.php?t=182276