In any case, the MikroTik device will work like this - a new device is connecting to client's AP - this new device is being redirected to local authorization service (obligatory by law), after authorization - MikroTik device allows further internet access.
So, routing, NAT, and firewalling? You have a short list of
options. The CCR1036 or the CCR1072.
If each user gets 1Mbps (1 million bits per second) and a typical packet is 1KB (1 thousand bits) then that is 1,000 packets a second. If you have 3,000 active users all streaming at the exact same second (not truly going to happen), you would need something that could move 3 million packets a second.
But, you'll be applying rules, QoS, and so on, I guess. So, looking at the different MikroTik options ... and their test results (which show packets sized at 1,518), the only safe consideration is the
CCR1072. At $3,000, that is an investment. I should think you should start off with the cheaper
CCR1036-12G-4S-EM and prove your real world usage.