Does anyone know if the hEX PoE provides some kind of grounding terminal?

It doesn't. (Just looked at one.)

However, you may well not need it. Whether you do still need it depends on what actual problem you're trying to solve.

If you're hoping a little 24-gauge ground lug will arrest lighting, for instance, you're dreaming. No, my friend, that's called a fusible link at such energies. Fortunately, it should vaporize before it can start a carpet fire.

If I had to put WAPs outdoors, I'd find a way to get local power for them and run fiber to them instead, giving much better lighting protection. You still have to take care of surge protection for the local power connection, and you should budget for replacing the most exposed WAPs when they "take a hit for the team," but these are endpoint problems. I think that's a better tradeoff than providing electrically-conductive paths back into the network core, where we keep the largest concentration of expensive devices and the people that run them.

But that's me.

there are two houses and I just want to place hEX in one house and cAP in another one.

All right, in that case what's most likely to happen is that one circuit in one house is hit — never mind how — and the resulting surge couples through that cable to another circuit in the other house. The cable itself and the conduit are extremely unlikely to be the direct-hit path, being too close to the ground even where they come up to go through the walls.

So I'd still go with fiber.

That rules out the cAP, but I don't see anything else I like that does have fiber on the MikroTik side. The RB2011UiAS-2HnD-IN is too old tech-wise, and the RB4011iGS+5HacQ2HnD-IN is ridiculously overpowered. If I had $250 to spend on wireless equipment in the second house, I'd slice off $49-69 for a hEX or RB260 class fiber switch and put the rest into a mesh system from another company. That gets you RouterOS power with solid consumer-grade WiFi.

I just want the shielded cable to be grounded.

That's what the EE.SE answer is trying to get across: the Ethernet magnetics mean you don't need grounding if the isolation level suffices for your use cases.

There's a metal shield around the ports on the hEX PoE, and I was hoping it was electrically connected to the DC barrel plug's outer "ground" connector, allowing the wall wart to be this ground path you're wanting, assuming the Cat-5e cable shield (STP) is connected to it, but alas, it isn't so. (Just measured it.)

The SFP cage is so-connected, oddly enough.

Do I just need to ground the cable's shield separately on either side and that's it?

If my shield test above showed that it was already done, it would be redundant, but instead what it shows is that by doing so you're connecting two different "grounds", which can be dangerous.

So no, don't do that!