OK, done.
Thinking a bit further about it, it all makes sense. There is no magic involved.
When NOT using standard base vlan with pvid=1 (as described in pcunite’s fantastic series), cap device needs to be modified to have trunk port for all possible VLANs being thrown at it but in this case also tagged to bridge since that’s where capsman will add the dynamic interfaces.
Also make sure it gets IP services from router (BASE_VLAN setup).
Access point setup for reference:
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/4
Dynamic wifi interfaces will be added to bridge with pvid set in accordance with their config as provisioned by capsman.