I think so, but with a trade-off in functionality.
If you look at the NAT rules automatically created by the Hotspot there's a jump action at the bottom of the hotspot chain for authenticated traffic targeting hs-auth as a chain. The hs-auth chain has one entry, redirecting all Hotspot http traffic to a servlet on the router. This is so that the Hotspot servlets act as a (non-caching) proxy of sorts so they can rewrite traffic if necessary for displaying advertisements etc. There's also a rule at the very top of the hotspot chain that jumps to pre-hotspot, it is usually invalid since that chain doesn't exist by default.
You could make entries like this:
/ip firewall nat
add chain=pre-hotspot hotspot=local-dst action=return
add chain=pre-hotspot hotspot=auth action=accept
To stop the rewriting for all authenticated traffic unless it's destined for the router itself.
At that point any services provided by the Hotspot servlets for passthrough traffic would no longer be available.
Also, I haven't tested any of that.
