CTAG & STAG Question

Hi

I am struggling to find information on how to do some configuration for my customers connection and hope someone can point me in the right direction.

We are going to be getting a public IP and routed block from ISP via STAG & CTAG.

Example
WAN IP : 123.123.123.123/31
Secondary routed range : 124.124.124.124/31
Both of the above will be delivered with STAG 100 and CTAG 301

The customer is using their own firewall so will be wanting to use the secondary routed range (without any VLANs on their port)

ISP — STAG100/CTAG301 —> ETH1 Mikrotik (ISP Facing) - ETH2 Mikrorik (Customer CPE facing) ---- NO VLAN — > Customer CPE (124.124.124.125/31)


Im assuming both ETH1 & ETH2 will be in a bridge with the IPs 124.124.124.124 & 123.123.123.123 ? but unsure how to ensure ETH1 carriers the STAG & CTAG but it stripped/filtered from ETH2?
Any ideas how to achieve this?