No; the CRS3xx line supports bridge VLAN filtering, which allows a single bridge to support many VLANs. This will in turn keep your traffic separate as desired, when appropriately configured.
I will have a look and try to learn how to setup VLANs (again)
This guide is well-regarded.
actually two bridges, one in each switch/router
If you wish to be pedantic about it, say instead “one bridge per switch chip”. There’s no point confusing matters by reporting the number of RouterOS devices as equal to the number of bridges present.
There are nuances beyond that basic case, if you’re interested…
Do I assume right the cameras may be assigned with yet another subnet
Each VLAN gets its own subnet, yes.
A common convention that keeps things simple is to put the VLAN ID in the third octet, so that e.g., VLAN ID 3 might be 192.168.3.x/24. Nothing enforces this; it’s purely for the network admin’s benefit.
Beware, however, that VLAN 1 gets handled as “special” in a lot of situations, which are hard to predict without a lot of testing and reading. It’s best to avoid using it unless you absolutely must. Therefore, your 192.168.1.x subnet would either need to be renumbered to follow this convention or you’d break the convention by using, e.g. VLAN ID 1001 for that subnet.
one interface living in .3.x space (cammera traffic would be collected through that one) and the other in .1.x through which recorded content would be accessed from devices connected to inner lan or do I still get the entire concept wrong?
Without knowing your equipment intimately, it’s difficult to advise. However, I will observe that one of the key properties of VLANs is that a given port can be a member of any number of VLANs. It is one of the primary practical distinctions between VLANs and either port isolation or multiple bridges. These latter schemes are rigorously exclusive: a given port can be on only one bridge or in an isolation group or not.
Point being, you could instead assign one port on your NVR to both the IPcam and security monitoring VLANs.