Each device one bridge.
Router define all vlans, and the associated subnets, routing and firewall rules.
Decided what each smart device needs to pass on in terms of data vlans aka trunk port to these devices… add management vlan.
Smart Devices:
ONLY management vlan is defined and the Ip address is best set static to the manaegment vlan.
Firewall rules not required
Only the management vlan is tagged with bridge on /interface bridge vlan settings.
http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1