What's the best implementation to perform the following:

1. Rate limit users using simple Queues
2. Shape traffic using mangle

Is it easier to try to do both in one router or simply perform rate limiting on one router and then insert a transparent bridge at the internet gateway to shape traffic using mangle?

i bet simple queue is the better way

I think that 2 machines are the the best solution to provide traffic shaping based on user address (for user-individual traffic limiting) and QoS at the same time.
Mikrotik can shape traffic only on OUTGOING interfaces, in best case you will have to use ether1 & ether2 (for example) plus global-in & global-out pair but to obtain these working (especialy mangle/traffic flow related things) at the same time you propably will need to spent about one month on testing different methods and testing them - depending on your TCP/IP knowledge.

If you'll have 2 machines there won't be any problem to set up src-address shaping on first and final QoS on another machine.
Because you'll have only two interfaces for ex. ether1 & ether2 on each routers and non overlaping mangle ip-marks...

ok, it can be done, but why, if you have hotspot solution

Hotspot is only gate that allows some users to entrance somewhere
within hotspot login you can user hotpot queues, but these are only simple ones, so if means that only max-limit.
If you have enough backbone (10Mbps for ten 1Mbps clients) (no overbooking) queue simple are fine, if you have overbooking, there are situations that users will eat all bandwidtch and latency will grow to 2000ms or move vaules...

but these are only simple ones, so if means that only max-limit...

you can use limit-at, max-limit and burst-limit in client's queues at HotSpot. see here for details. Or read text, written bellow:

rate-limit (text; default: "") - Rate limitation in form of rx-rate[/tx-rate] [rx-burst-rate[/tx-burst-rate] [rx-burst-threshold[/tx-burst-threshold] [rx-burst-time[/tx-burst-time] [priority] [rx-rate-min[/tx-rate-min]]]] from the point of view of the router (so "rx" is client upload, and "tx" is client download). All rates should be numbers with optional 'k' (1,000s) or 'M' (1,000,000s). If tx-rate is not specified, rx-rate is as tx-rate too. Same goes for tx-burst-rate and tx-burst-threshold and tx-burst-time. If both rx-burst-threshold and tx-burst-threshold are not specified (but burst-rate is specified), rx-rate and tx-rate is used as burst thresholds. If both rx-burst-time and tx-burst-time are not specified, 1s is used as default. Priority takes values 1..8, where 1 implies the highest priority, but 8 - the lowest. If rx-rate-min and tx-rate-min are not specified rx-rate and tx-rate values are used. The rx-rate-min and tx-rate-min values can not exceed rx-rate and tx-rate values.


regards,
C. G.

yes you can have limit-at, but that will not work corectly
If you want to test it - set 4 queues with 2Mbps max and 512Kbps limit-at, and start download on these 4 hosts, you will see 8Mbps of usage if you have enought bandwidth, if you will have only 2Mbps, one or two hosts will eat all of bandwidth, esspecialy if they'll use p2p....
In case of queue tree, you can shape traffic that you will have global limit on specified amount (like 2Mbps) and other hosts will share this bandwidth.

I hope that you understand my point of view...

yes you can have limit-at, but that will not work corectly
If you want to test it - set 4 queues with 2Mbps max and 512Kbps limit-at, and start download on these 4 hosts, you will see 8Mbps of usage if you have enought bandwidth, if you will have only 2Mbps, one or two hosts will eat all of bandwidth, esspecialy if they'll use p2p....
In case of queue tree, you can shape traffic that you will have global limit on specified amount (like 2Mbps) and other hosts will share this bandwidth.

I hope that you understand my point of view...

yes, it's absol. true. BUT, I understand enought bandwith if real bandwith is 70% of shared one. for vip clients, e.g.
regards,
C. G.