IMHO, correct or incorrect is in the eye of the beholder.
Your AP now behaves as bridge for the “normal” wi-fi and as router for the “guest” wi-fi,
If you prefer you have double (or triple, depending on what is your connection to the ISP) NAT on the guest “wi-fi”.
This may well drive a lot of network experts up the wall in desperation.
But in practice the main downsides are probably only some little more CPU usage, a slightly increased latency and a reduced bandwidth, all things that you probably do not care about.
Usually a few firewall rules (besides the one you already added) are added to allow the guest clients to connect only through the AP and router, preventing access to them and to other guests devices, like:
/ip firewall address-list
add address=10.10.10.2-10.10.10.254 list="Guest WiFi"
/ip firewall filter
add action=drop chain=input dst-address=10.10.10.1
add action=drop chain=forward dst-address=192.168.88.0/24 src-address-list="Guest WiFi"
add action=drop chain=forward out-interface-list=!WAN src-address=10.10.10.0/24
Your current firewall rule:
/ip firewall filter add chain=forward action=drop src-address=10.10.10.0/24 dst-address=192.168.88.0/24
unlike the one above with the address list should also prevent the AP (10.10.10.1) to access the router and its subnet (192.168.88.0/24), but it could be fine, again it depends on what you prefer.
Your current interface list member needs to be corrected, generally and for having the above last rule work, like:
/interface list member
add interface=bridge1 list=WAN
add interface=bridge-guest list=LAN
I don’t think that in such a setup the bridge-guest is actually strictly needed, i.e. I believe you could use directly the guest-wifi interface, but it has to be tested, to me a bridge with only one interface in it is counter-intuitive.