How can I make sure that hot spot users are unable to access my internal network?
If need be I can attach the Camera directly to the nano.

Install firewall filters in the forward chain that drop packets from the Hotspot network to your other internal networks.

Awesome! That is what i was thinking...
So lets say the hotspot network is 192.168.88.x
and the internal network is 10.1.10.x

I would need to install an accept rule to allow traffic to the gateway yes?
so 10.1.10.1 accept
Then
10.1.10.0/24 reject

Keep in mind this is my first RouterOS device.

I don't see why you would need to permit traffic to the "gateway".