Whether you use the base bridge interface or a vlan10 subinterface off the bridge is up to you. Both will allow you to configure any of the ether ports as hybrid links to access points.
The primary advantage to using the base bridge is that you are less likely to be locked out when you switch from the default vlan transparent mode with vlan-filtering=no to vlan-aware mode with vlan-filtering=yes.
The primary disadvantage of using the base bridge when vlan-filtering is active (vlan-aware), is that one vlan will be "different" and what vlan the bridge "is a member" of depends on the configuration of the virtual switch personality of the bridge device. Specifically the pvid associated with the bridge (which is essentially doing what /interface bridge port pvid setting does for the virtual switch's "external switch/bridge ports"). It applies to the "internal trunk" between the linux router's bridge interface and the virtual switch, and it controls which vlan on the virtual switch the untagged frames from the base bridge interface are classified to use on the virtual switch.
When all vlans used for data are tagged, then the vlan used on the virtual switch is explicitly stated in each ethernet frame (by the 12 bit vid that is part of the vlan tag). So mismatched vlans won't happen accidentally when plugging into another switch-port.
Understanding what is happening under the hood when you change the vlan-filttering option is the key to knowing whether changing it will lock you out or not. This is covered in the RouterOS bridge mysteries explained and Vlan-aware bridge mysteries threads. They are not light reading, but do have a lot of information, unfortunately the information is not consolidated into a single post.
Changing vlan-filtering only affects the operation fo the virtual switch part of the bridge. It does not affect the behavior of the base bridge interface or any vlan interaces under it. The traffic from the base bridge before getting to the virtual switch is always untagged, and traffic from the vlan interfaces are always tagged. vlan-filtering just changes the way the "virtual switch" behaves. It is really no different than changing the vlan-filtering on an external switch connnected to a hybrid link. When vlan-filtering=no is in effect, the "virtual switch" operates in a very similar way to a dumb switch made in the last 20 years. It just forwards frames in the same format they were in. The switch knows nothing about vlan tags; they are just data. Ethernet frames with Ethertype 0x8100 (TPID) are treated identically to ethernet frames with ethertype 0x0800 (IPV4) and are just forwarded as is. Once vlan-filtering=yes is in effect, the "virtual switch" can modify the ethernet frames (to add/remove IEEE 802.1Q tags)
@anav has an aversion to using the base bridge for anything, at least once vlans have be enabled. But he also recommends removing a port from the bridge so you have a get out of jail free card when you are working with vlans.
I suspect that @gardlaerk is a new incarnation of Dr Jekyll so Mr Hyde may still be around 
.