So these two statements are interesting:
"Do I need to open ports on customer routers?"]
No. Every device connects out to MikroMind over its own WireGuard tunnel, so routers behind NAT are fully manageable. Nothing inbound is ever opened on the customer's network.
"What RouterOS versions does MikroMind support?"
RouterOS 7, tested against current stable releases. Devices still on RouterOS 6 are automatically upgraded during onboarding, and every device is kept on your target firmware from then on.
Forced upgrade 6->7 .... hmmmmm