How to isolate devices behind Mikrotik from devices connected to ISP router

RouterOS Beginner Basics
22

As stated the requirements and limitations are NOT clear.
If the purpose is to serve to your flatmates, then the internet is not involved and minimal security risk.

Basically your ISP router gives a private IP to the Hex Router and then everything else is behind the hex router.

I would create a vlan for your flatmates, a vlan for yourself, and a vlan for the server.
Flatmates and you can access the server, the server cannot access anything, unless you need the server to connect to the internet to get updates etc.......... this can be done manually in rules to allow access and then shut it out.
Flatmates and yourself probably want internet access as well.

If you want to let others on the www, outside your ISP router, play on your server, then you are asking for trouble and is not recommended, that is the reason to use STEAM etc,

The secure way, if needed is for External users to only come in on a secure path.
Suggest wireguard, or zerotier, whichever gives best performance experience for the outside user.

23

Some other thoughts:
If allowing outsiders onto your server, you need to ensure they cannot login to either of the routers.
The isp router, if used is likely accessible from the inside via its wan ip address.
You would need to block this access (simple if static wan ip address, less simple otherwise)
For the mikrotik, you could have a dedicated off bridge management port with its own IP address, and perhaps a wireguard connection/interface used just for management.
I would turn off all possible /ip services except winbox.