Does this require hardware support from the SOC?
Driver, firmware and hardware need to support IEEE 802.11W, the rest would be software-only (hostapd). IEEE 802.11w is older than WPA3 and was already possible (and a good idea to use) on WPA2, but quite some hardware/ firmware/ drivers are still struggling with this mandatory feature of WPA3.
Does MT7628 unfortunately not support IEEE 802.11w?
But the trouble is that 802.11s on openwrt seems to only support two encryption modes, WAP3 and open mode.
But I found on some documents that 802.11s seems to support the use of 802.1x.
I had to use an open network when using 802.11s on R1CL.
I don't personally own any mt7628 devices, but as far as I know mt7628 is kind of a hybrid - modern mediatek mips SOC with old RaLink wireless. rt2x00 has very, very recently seen some work for 802.11w support, if it's going to work at all, you need the most recent wireless backports you can get (master snapshots; no guarantee that it is working there, but chances are better).
It's worth looking forward to. 
It seems that I should continue to use unencrypted mesh. Fortunately, there are not many terminals supporting 802.11s. No one around my house should find this unencrypted mesh node.