ROS Port isolation on CRS328-24P

Hello!

I need some help to configure port isolation on CRS328-24P with ROS.
I have 2 different subnets on core router (10.1.0.0/23 on port2 and 10.4.0.0./23 on port2) isolated by firewall.
On CRS328 i want to make the following configuration:
ether1-uplink to router port2 → ether2-ether4 i need to comunicate with each other and with uplink on ether1
ether5-uplink to router port4 → ether6-ether8 i need to be isolated and comunicate only with uplink port5

I mention that in this case i do not want to use VLANs, nor CRS operate in SWOS.
Also in this case, i do not want to use multiple bridges (disable HW, wich i need), nor bridge horizon (also disable HW on port, wich i need).

My core router is a netgate2100, basic config.
CRS328 has ROS v7.17.2, default config, only one port is not part of default bridge, is added in interface list for discovery and on site management purposes.

Thanks in advance!