Interactive control of which stations are allowed to connect to hostapd softAP

Question

Setup:

I have two devices working in IEEE802.11 infrastructure mode. I have the station using wpa_supplicant to establish connections and the access point on the other device provided via hostapd.

What I want to achieve:

1. On Station side to read out the (vendor specific) Information elements provided by the Access Point in the beacon/probe response Frames and depending on the values provided there to decide, if I want to connect to that Access Point.
2. On Access Point side to read out the (vendor specific) Information elements provided by the station in the (re)association request Frames and depending on the values provided there to decide, if I want to allow a device to connect to my Access Point.

What I was able to achieve:

It turns out that to realize 1 is pretty straightforward. On station side wpa_supplicant provides several mechanisms to control, which access point to connect to via the wpa_ctrl Interface. For example I can initiate scans for Access Points, read out the Information elements provided by the beacon or probe Response Frames via the BSS command and then depending on the values seen in the Information elements initiate the Connection.

What is missing:

I have read the wpa_supplicant/hostapd documentation but I was not able to find similar capabilities for hostapd. Therefore, I was wondering:

1. Is there an interactive way (I know you can define MAC-address based accept/deny lists) to control Connections to a softAP provided by hostapd once an association request Frame arrives at the Access Point?
   Or do I have to allow association for each Station that wants to associate to the Access Point?
2. Is there an alternative to using hostapd for creating the Access Point that does provide such interactive Access control capabilities?

Side remark: This is not intended to serve as a bad attempt/replacement for proper authentication via WPA2. The Access Point advertises Services via the Information elements and the Station does the same. They only should be able to connect, when they are found to be compatible.