The RB2011 is a “special” device that has two switch chips:
https://help.mikrotik.com/docs/spaces/ROS/pages/15302988/Switch+Chip+Features
Atheros8327 (ether1-ether5+sfp1); Atheros8227 (ether6-ether10)
The “modern” way to do what you want to accomplish (good on any Mikrotik hardware) is surely VLANs, but on that particular device maybe - just maybe - you could consider the “older” way making use of two separate bridges.
I would think (but I know very little about VLANs) that the “old” way is simpler in your specific use case, or, if you want to go all the way down VLANs you might need (or not?) to.“connect externally” the two bridges with a cable (losing two ports) to connect everything together, but since ultimately you want two separate bridges that don’t talk to each other, the 2011 seems like the perfect device to do that, check:
http://forum.mikrotik.com/t/rb2011-what-to-do-with-second-switch-when-doing-vlan/138436/1
http://forum.mikrotik.com/t/rb2011-vlan-slow-lan-speed/133125/1
Hopefully anav will intervene with proper VLAN advice