How secure is...EAP + dynamic keys

RouterOS Wireless Networking
1

Goal: to create a secure wireless network with radius MAC authentication without having to have a pre shared key

I can do this with a Security Profile and here’s what I am thinking:

Mode: dynamic keys
Authentication: WPA2-EAP
Unicast/group ciphers: aes/ccm
Use Radius MAC Authentication

Will this, since it will talk to my radius server to authenticate a MAC address:

  1. Be secure as if I was using WPA2-PSK and entering a key - I assume with dynamic keys the key is simply generated automatically…and how often does the key change?

Is tkip or AES-ccm best?
2) Processing power - any idea on the # of clients w/ this type encryption a RB532A can support?
3) Allow me to also set Mikrotik bandwidth limits like I can with hotspot users

Thanks!