You would need to invlove a radius solution like ACS to do a mac filter by SSID and radius..

http://www.cisco.com/en/US/products/hw/wireless/ps430/prod_technical_reference09186a00801444a1.html

3.5  RADIUS-Based VLAN Access Control

As discussed earlier, each  SSID is mapped to a default VLAN-ID on the wired side. The IT  administrator may wish to impose back end (such as RADIUS)-based VLAN  access control using 802.1X or MAC address authentication mechanisms.  For example, if the WLAN is set up such that all VLANs use 802.1X and  similar encryption mechanisms for WLAN user access, then a user can  "hop" from one VLAN to another by simply changing the SSID and  successfully authenticating to the access point (using 802.1X). This may  not be preferred if the WLAN user is confined to a particular VLAN.

There are two different ways to implement RADIUS-based VLAN access control features:

1. RADIUS-based SSID access control: Upon  successful 802.1X or MAC address authentication, the RADIUS server  passes back the allowed SSID list for the WLAN user to the access point  or bridge. If the user used an SSID on the allowed SSID list, then the  user is allowed to associate to the WLAN. Otherwise, the user is  disassociated from the access point or bridge.

2. RADIUS-based VLAN assignment: Upon successful  802.1X or MAC address authentication, the RADIUS server assigns the user  to a predetermined VLAN-ID on the wired side. The SSID used for WLAN  access doesn't matter because the user is always assigned to this  predetermined VLAN-ID.

Figure 6 illustrates both RADIUS-based VLAN access control methods: VLAN assignment and SSID access control.

VLAN assignment: Both  "Engineering" and "Marketing" VLANs are configured to only allow 802.1X  authentication (LEAP, EAP-TLS, PEAP, and so on). As shown in Figure 6,  when John uses the "Engineering" SSID to gain access to the wireless  LAN, the RADIUS server maps John to VLAN-ID 24. This may or may not be  the default VLAN-ID mapping for the "Engineering" SSID. Using this  method, a user is mapped to a fixed wired VLAN throughout an enterprise  network.

RADIUS-based SSID access  control: David uses the "Marketing" SSID to gain access to the wireless  LAN. However, the permitted SSID list sent back by the RADIUS server  indicates that David is only allowed access to the "Engineering" SSID.  Upon receipt of this information, the access point disassociates David  from the wireless LAN network. Using this method, a user is given access  to only one SSID or to predetermined SSIDs throughout an enterprise  network.