I have this setup using Juniper SRX and Unifi APs currently, so pretty sure it is doable on Mikrotik.
VLAN-666 Internet DIA w/public IP
VLAN-10 10.100.10.1/24
Server Network (Think DNS Server)
VLAN-11 10.100.11.1/24
Personal network, has access to VPN and all hosts on VLAN-10
VLAN-12 10.100.12.1/24
Family network.. Printers, TVs, xbox, iPads, garage opener, etc.
Has access specific services on server network
does not have access to VPN
Outbound DNS is blocked except for the specifically allowed DNS servers
I’ll probably work on something similar on Mikrotik, where VLAN-11 will default route via VPN. Will probably be a couple of weeks before I get to that project.