No need for bridge related subnet it should do no dhcp servicing.
vlan10 managment 10.0.20.0
vlan20 NAS 10.0.20.0
vlan30 untrusted ( guest wifi?) 10.0.30.0
vlan 5 home 192.168.0.0
How to setup up vlans —> http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1
Since unifi by default expects management vlan untagged, suggest the following concept
All smart devices get IP address on management subnet. This includes any device that can read tags, typically switches and access points.
Your diagram concerns me a bit because you show two connections going to the same place from router and from l3 switch to lower box, bad idea or perhaps your diagram is poor and thus misleading.? I will assume what you mean is some devices have the option of connection to router wifi or to a separate ap wifi?
In any case
/intrerface bridge port setup
ether1 is hybrid port (no frame types, no ingress filtering) pvid=vlan10
ether2-4 & WLAN ports, are access ports frame types=priority and untagged frames pvid= applicable vlan (only one vlan per access port of WLA)
/interface bridge vlan setup
vlan10 is tagged on bridge, and untagged on ether1 ( this assumes no other smart devices on ether2-4 of chateau or wlan ports)
vlan 20 is tagged on bridge ans ether1 and untagged on applicable etherport(s) or WLAN(s) ( for eth1 assumes vlan20 must be trunked to switch)
vlan30 is tagged on bridge and ether1 and untagged if applicable on etherport(s) or WLAN(s) ( for eth1 assumes vlan30 must be trunked to switch)
vlan5 is tagged on bridge and ether1 and ungtagged if applicable on etheport(s) or WLAN(s) (for eth1 assumes vlan5 must be trunked to switch)
Personally I would take ether5 off the bridge give the etherport and do all my configuration from there much safer…
as per … https://forum.mikrotik.com/viewtopic.php?t=181718