Maybe this link can help you: http://www.tp-link.com/en/faq-927.html
You may check the MAC address showing up on the router when a device is connected to the repeater and then block that MAC address. The devices may show different MAC address on the router when they are connected to the router, and when they are connected to the repeater.

I think that link refers to different devices. On the TL-WR702N set to repeater mode, the only option is the WPS mode which is set to auto. When a device is connected through the repeater
it seems to show the same MAC address to the router as when connected directly. On the router I have the MAC filtering set to 'allow' and entered all the devices in my house.
If I disable the MAC address of a device in the address filtering on the router it won't connect to the router but still connects through the repeater.
If the repeater were modifying the MAC address it would never connect because that modified address in not in the list of allowed addresses.

Yeah, TL-WR702N use 3 address frame to communicate with TD-W8970. TD-W8970 will only see the MAC address of TL-WR702N.
You may need a different device. The FAQs Vieldcs provided has mentioned some models.