The preferred setup is indeed to have the NAT/Firewall/DHCP server in the wAP, not in the hAP. (http://forum.mikrotik.com/t/transparent-bridge/146361/1)
Then you just work with “station” to the ISP, not pseudo bridge. DHCP works in theory with pseudo bridge, but the Mikrotik bridges seem sometimes not to be able to handle this properly. (DHCP lease gets offered but not bound. see: http://forum.mikrotik.com/t/ros-6-38-serious-dhcp-server-problem/105259/1 , no real stable solution or root cause found yet. STP protocol and bridge port MAC learning are suspects.)
In all cases check where you define DHCP client and server. If interfaces are bound to the bridge, IP addresses, DHCP client and DHCP server should only be defined on the bridge, not on the interface.
In your pseudo bridge setup the wAP can also have an IP address. If the ISP does not allow 2 IP addresses, he might be caching the wAP MAC address for many hours. (while denying any other DHCP request from another MAC address. ISP trying to avoid double connections.)