I am in the process of rolling out a WISP & will be using Mikrotik as the PPPoE server & the Hotspot server & the general router for the entire public network. I am looking to provide both services through the same set of APs all connecting back to the Mikrotik router. Are there any security considerations when putting PPPoE & hotspot on the same interface? Is it better to install 2 NIC's & seperate the services out to 2 different interfaces? Does it even make a difference if they're both connected to the same network switch? Or would having 2 different interfaces connected to the same network switch be problematic in itself?

Additionally, I would like to route the end user traffic through 2 different interfaces, depending on the service the client purchased. I am offering a Content Filtering service, & the only way I've found to implement it is if I route it through a separate subnet & interface on my firewall. So basically, if the user does not want filtering they get routed through interface A on the Mikrotik & if they do want it, they get routed through interface B. Both sets of users would be connecting through interface C on the Mikrotik (the interface that the PPPoE server & Hotspot is on). I plan on using my radius server(TCC Radius) for both authentication & accounting. What's the best way to implement this?

While I'm not sure if it's recommended or not. I've done this - using 2.9.11 I'm running hotspot and pppoe on the same wlan interface (thus the same ssid - which was important)

Radius has radius accounting packets that can inform your radius server how long the user was on, and how much they've downloaded.

You can set routes, and firewall flags in radius (check it out in the mikrotik manual) - that shuold help you with your "filtered" and "non-filtered" setup