You’ve misunderstood the input / output chains.
Input chain means traffic bound for the control plane of the Mikrotik - i.e. packets for the Mikrotik itself.
It doesn’t mean “packet ingress” as it does in Cisco interfaces.
Likewise, Output chain means packets sent from the Mikrotik’s CPU out to the world somewhere.
What you want to do is use the FORWARD chain - which is used whenever a Mikrotik will forward an IP packet as a router.
On the rules in the forward chain, you can specify in-interface=xxxxx our out-interface=xxxxx or src-address, or dst-address, etc.
So in order to protect the mgmt network from the users, you will need to use the input chain to protect the Mikrotik itself, and the forward chain to prevent the users’ packets from forwarding into the management network.
If you’re using PPPoE sessions, then you could even create a custom filter chain which defines the policy you want to apply to users, and then specify this chain in the ppp profile as incoming filter (or outgoing filter) - and in this case, these behave more like you were expecting - i.e. packets going out the pppoe interface to a user will be passed to whatever chain you specify as “outgoing filter”
EDIT:
I missed this when reading your original post - this rule should in fact do what you want, except that the interface criteria is breaking it.
Since your users are pppoe sessions, the users’ IP packets aren’t logically arriving on any ethernet interface, but on the point to point interfaces, so when checking user packets, the in-interface criteria is false and the rule doesn’t match.
In general, try not to specify too many criteria, especially if they’re redundant. You want to block IP range X from talking to IP range Y so just use the IP addresses and no other criteria. If you did want to allow X->Y if the physical inbound interface is ether4, then sure, add in-interface=!ether4, but simple rules are more efficient, and easier to read and follow their logic.
As I mentioned in another thread - the key about interfaces is that if an Interface has no IP address assigned to it, then IP rules aren’t going to apply to it.