In the access-list tab entries, you can specify the interface that "this entry" will apply for.
So if you want to allow mac AA:BB: etc. as a guest only, you'll specify interface "vap1".
At the end, don't forget to add a catch-all entry with no mac address, no interface and deny connections. So if your not accepted by previous rules, you're denied Wi-Fi access.
Sent from my cell phone. Sorry for the errors.
Alain Casault, Eng.
If I helped you, let me know!