Hello everybody,
I would like to configure scenario like that:
On MT I've got DHCP server with one pool for trusted macs and one another with untrusted (I mean untrusted are users which know wpa key but aren't my employees).
So the trusted mac should get address from one pool and untrusted from second pool.
On ethernet I could create vlans but what can I do to resolve it on wlan?

Why don't you just use two different SSIDs. Create a VAP of WLAN1 and separate the traffic that way?