With this extensive guide you will be good to go using VLAN’s:
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Once you get the concepts you will never go back.
The other option I see is setting client-isolation on an access-list, filtered by SSID. Haven’t tried that myself (as I’m using VLAN’s).