CR3xx should be configured with a single VLAN-aware bridge as the switch chip is automatically used, a.k.a. hardware offloading. See https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_VLAN_Filtering and there is a good primer on Mikrotik VLANs in the forums http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
The port connecting to your pfSense can either have all VLANs tagged (a.k.a. ‘trunk’), or one VLAN untagged and the remainder tagged (a.k.a. ‘hybrid’ or ‘trunk with native’).
It is considered to be good practice to separate general and iSCSI traffic, the iSCSI network shouldn’t need access to any other networks or the internet. You could either use separate network interfaces on devices connecting to untagged (a.k.a. ‘access’) switch ports for the appropriate VLANs, or a single network interface connecting to a trunk or hybrid switch port.