My primary router is the RB2011UiAS-2HnD-IN on which portable devices connect via wifi secured with password and MAC via ACL

New users are added to the ACL, to gain access.

I am installing a Wap - RBwAP2nD to add connectivity outside and I would like to know if it is possible to somehow send the RB2011UiAS-2HnD-IN "ACL" to the WAP to update its "ACL" as new clients are added or removed / disabled.

Better than a script: Use CAPsMAN, set the 2011as master and the wAP as slave; Under CAPsMAN devices on the 2011 you'll have both units as virtual wireless interfaces.

How is the acl list stored on the router?

Do you mean under CAPsMAN? It is managed in the same exact way as an standalone AP; but will apply to all (if so desired) or any specific CAPsMAN managed wireless interfaces, providing a powerful "central point" for management, and some extra features only available on CAPsMAN (SSID regexp, etc...)