MikroTik recommends that you either use Quick Set for everything and don’t touch other settings, or don’t use Quick Set at all. With regards to using bridge filters to segment off guest WiFi—yes, you can use that for your scenario. It works by dropping all forwarded Ethernet frames from/out the specified wireless interfaces. Since the WAN interface (eth1) is not a member of the bridge, WAN traffic between eth1 and wireless interfaces is not subjected to these filters.
Many consumer routers use the same approach with ebtables (L2 bridge firewall) for their guest WiFi functionality. I know some Asus routers do.
You also don’t have to use Quick Set to use these filters. Now that you know what they are, you can just manually add them to your custom configuration.
You would still want to lock down access to the router itself with IP firewall, unless you are OK with it being accessible from the guest network. The most secure approach is to allow only DHCP (UDP 67) and DNS (UDP and TCP 53) from the guest network to the router (input chain).
The IP firewall part still applies if you go with VLAN approach. Default firewall rules don’t block any access to the router from the LAN side.
One thing to keep in mind is that bridge filters are quite demanding on CPU. I used the same bridge filters for guest WiFi on hAP ac2 and found out it limits the maximum throughput on WiFi. See http://forum.mikrotik.com/t/vlans-with-wifi-qcom-ac/182887/17
This may not apply to you since hAP ax3 has a bit more powerful CPU (but not by much), as seen on the official test results. This limitation may not mean anything in practical sense if your WiFi traffic doesn’t need to exceed 400Mbps.