MikroTik

I was wondering if such a setup is possible: i would like to use omnitik as ordinary access point that connects to internet through ethernet port, but instead of wired port, connects to other wireless ap and then functions as ordinary router with additional virtual ap.

I was thinking about switching to station mode and then broadcast virtual ap,but how to configure firewall so that it separates both wlans? Is it possible at all?

Ap mode with wds uplink and virtual APs is the way.

thank you