The recommended setup for Mikrotiks with VLANs is to use a single VLAN-aware bridge, there is a good primer in the forum http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
If the wired client connections (what you have called terminals) are on one network you can use CAPsMAN forwarding to segregate the wireless network instead of VLANs, although this does potentially reduce throughput and increase CPU load on the APs and CAPsMAN controller due to the traffic encapsulation it uses.
VLAN-tagged traffic is just a different ethertype and slightly larger packet, which although more than the original ethernet standards, is handled by many unmanaged switches unless they use very old chipsets.
It isn’t clear what you mean by “second IP domain managed by the internet router” - is this a second IP address on one subnet, a second subnet provided on a different port or VLAN on the internet router, or something else.