Filter from inside to the internet is a yes. Filter from the internet is a no, because no MAC address is send with the package.
So MAC is only available on the side of the switch in the Mikrotik and not at the router side/outside.
Two RB760iGS (hEX S) in series. One does PPPoE and both do IKEv2.
Running: RouterOS 6.47.beta.x / Winbox 3.21 / MikroTik APP 1.3.10
Android device owners, use https://github.com/M66B/NetGuard/releases (no root required)