Since RouterOS v6.43 it is possible to create a Private VLAN setup on CRS3xx series switches, example can be found in the Switch chip port isolation manual page.