I currently have everything connected to a switch, linked to Mikrotik 450G - everything sees everything, no access limitations within LAN

Now I need to add a new AP with limited access to a certain IPs, so I'm thinking to plug it into next free interface on the router to be able to apply Filter rules

What is the recommended way to implement limited access to certain IPs for this AP's clients: should I put the new AP to a separate subnet, or use VLAN, etc?

You can add acees list in your AP.
You can do NAT for selected IP's Only.

Huh? NAT within LAN? Why?

If I plug it in as is I will be on the same ip range.

My question was whether I should set it up as a separate subnet or VLAN to ease its access control?

Send from Android phone