Have you seen this?
The /interface/bridge/vlan and /interface/bridge/port settings only control the tagging and untagging of frames as they enter or leave the bridge itself via its member ports. These settings are only taken into account if vlan-filtering on the bridge is set to yes.
The functional block created using /interface/vlan/add is not a part of any bridge, so the vlan-filtering setting of a bridge has no effect on it. It is just a pipe that tags frames in one direction and untags them in the other one. The “tagged” end of the pipe is attached to some existing L2 interface (in this particular case, the internal interface of the bridge Bridge-Lan), the “tagless” end is an interface itself (in this particular case, Bridge-Lan.1100.IoT). On the tagged end, it ignores frames tagged with any other VLAN ID than the one it has been configured with.
Sorry for the confusion, the configuration I have posted was a “from scratch” one, intended to show just the bare minimum required, not a modification of your existing one, as ether2 is also not an access port to VLAN 1100 in our current setup. Of course you do not need to replace one VLAN interface by another that only differs by name.