As to the concepts of solving your task (completely possible, BTW), I advise you to read through this excellent tutorial.
After you have your setup up and running in software (with vlan-filtering on bridge), you can start to consider implementing things in hardware. You’re mentioning hEX … which particular type? If your hEX is RB750Gr3, then forget about it, that device’s switch chip (MT7621) doesn’t support VLAN in hardware (check switch chip features) and you’ll have to do it in software anyway.