I suggest you to start with this tutorial. It is done using the new style VLAN-aware bridge, which works very fine. However it comes with penalty that it’s done in software and RB2011 with its relatively weak CPU will struggle. But when you get things running, you can convert the config to HW-offloaded one.
When it comes to that: there’s an urban legend running wild that AR8227 switch chip can’t do hybrid configuration (tagged and untagged on same port). 100Mbps ports (ether6-ether10) on RB2011 are hooked to such chip. This doesn’t affect the SW way mentioned at the begining of this post.