nobody knows??

2 - My AP TL-WA901ND is in the IP network 192.168.10.1 with DHCP Enabled and SSID "xxx2".

I think so that you need WISP mode in your network staff. Typical access point, like WA901ND, doesn't have NAT mode.

For me I may try 2 way,

-------------------------------------------------------------------------------------------------------

Plan A, (may not work)

Source of Internet or Gateway (DHCP)- 192.168.100.x (Group A)
-
Offsite with TL-WA901ND as "Bridge with AP"
Sample:
Survey and connect to Gateway 192.168.100.x (Group A)
Local Wireless setting to "AnynameUlike" and WPA password stuff
Network setting to "Statis IP"
IP setting to 192.168.10.1 / 255.255.255.0 (or any you want for Group B)
DHCP Server enable
-
Then Group B just connect to TL-WA901ND SSID

--------------------------------------------------------------------------------------------------------

Plan B. Put one old or cheap router behind TL-WA901ND. Idea is,

Source of Internet or Gateway (DHCP)- 192.168.100.x (Group A)
-
Offsite with TL-WA901ND as "Client mode" and bridge with Gateway 192.168.100.x (Group A)
Sample:
TL-WA901ND (Client mode)
Survey and connect to Gateway 192.168.100.x (Group A)
IP setting to "Static", IP address to 192.168.100.254 (or any unused)
DHCP to Disable
-
Connect via Ethernet of TL-WA901ND to Internet port (WAN port) of old or cheap router
Sample:
Router LAN IP 192.168.10.x (Group B)
Internet Connection setting to "Static"
IP 192.168.100.154 (or any unused)
Gateway 192.168.100.x (as Group A Internet access Gateway, sample 192.168.100.1)
DNS 8.8.8.8 / 8.8.4.4 (or any of your local DNS)
WiFi setting for Group B (SSID and WPA password stuff)
-
Then all Group B connect to the old or cheap router SSID.

Best regard.