You need a managed switch if you want to push vlans. Unmanaged switches can't recognize vlan tagging.
I believe I understand what you're trying to accomplish - the best way to do that on unmanaged switches is to set up IP binding under /ip hotspot ip-binding
You can at least exclude the mac addresses of the network devices you want to access without the hotspot clamping down its packets. You need to set up an IP on the MT router on the interface serving the hotspot - at least from that point you should be able to ping the network devices from the MT once the binding has been set up. The ip-binding type is bypassed.
For example:
/ip hot ip add mac-address=00:15:6D:xx:xx:xx type=bypassed comm=ubnt
If the ubnt device is on the default ip 192.168.1.20/24 then you should be able to ping it from an ip on the same subnet assigned on the MT interface where the hotspot is running.