How does a Mikrotik determine which interface is outside of the firewall and which is inside? Particularly when you are just trying to connect separate subnets by means of routing?

It is up to you to configure which is which.
Just build your firewall rules in such a way that the traffic is allowed/blocked the way you want it to.