It sounds like you are almost there, but I would avoid the VLAN filtering on the bridge in combination with the switch chip. I think it's one or the other, but someone might come along and correct me any minute
As a starting point I would try to stick to connecting on the CRS first without using the switch. Once you have proven the CRS is doing VLAN's correctly then it is easier to move onto the switch. otherwise you have both the CRS and switch as variables in terms of the way they are handling VLAN's. Can you dedicate an access port on the CRS for test device connectivity?
A good way to check the status of VLAN comunications is to use the mikrotik Torch function on the bridge or the VLAN sub interface. On the bridge you would want to open Torch, stop the capture as changes to the filter only happen when you stop and restart the caputre, click on the vlan checkbox and restart. You will now see all traffic running through the bridge, with the VLAN id shown. When using Torch on the VLAN sub interface, the VLAN field always seems to be blank, but given you are only looking at the sub interface for the VLAN, any traffic going through it is clearly on that VLAN.
The below is a subset of my CRS config, but I think from what you described it is the same as what you are doing. This config is working for me in a home environment, but I am not a netwoking or Mikrotik expert and can make no claims to this being best practice. I'm also very happy to have my mistakes pointed out by others, as I'm sure there are some in there
Also worth noting and you will see from the gateway, the fact that VLAN's 200 & 300 have no assigned IP addresses and the fact that ports 1, 21 and 23 go to a seperate router, that I do no routing on the CRS itself. This is likely to mean that your config is different. although the VLAN config should be the similar.
This is edited slightly to remove complexity around my config that you probably don't ahve and cut down significantly to remove CAPsMAN etc. config, so it is possible that there may be some small mistakes in there, but it will give you the main idea of the approach I have taken.
# jul/17/2018 02:45:04 by RouterOS 6.42.6
# software id = V17F-QGMR
# model = CRS125-24G-1S
add name=bridge1 protocol-mode=none
set [ find default-name=ether1 ] comment="vlan 100 - Router"
set [ find default-name=ether17 ] comment="Trunk for Testing"
set [ find default-name=ether18 ] comment="Trunk 1"
set [ find default-name=ether19 ] comment="Trunk 2"
set [ find default-name=ether20 ] comment="Trunk 3"
set [ find default-name=ether21 ] comment="vlan 200 - Router"
set [ find default-name=ether22 ] comment="vlan 200 - Access Port"
set [ find default-name=ether23 ] comment="vlan 300 - Router"
set [ find default-name=ether24 ] comment="vlan 300 - Access Port"
add comment="Internal Zone" interface=bridge1 name=vlan100 vlan-id=100
add comment="Second Zone" interface=bridge1 name=vlan200 vlan-id=200
add comment="Guest Zone" interface=bridge1 name=vlan300 vlan-id=300
/interface bridge port
add bridge=bridge1 interface=ether1
add bridge=bridge1 interface=ether2
add bridge=bridge1 interface=ether3
add bridge=bridge1 interface=ether4
add bridge=bridge1 interface=ether5
add bridge=bridge1 interface=ether6
add bridge=bridge1 interface=ether7
add bridge=bridge1 interface=ether8
add bridge=bridge1 interface=ether9
add bridge=bridge1 interface=ether10
add bridge=bridge1 interface=ether11
add bridge=bridge1 interface=ether12
add bridge=bridge1 interface=ether13
add bridge=bridge1 interface=ether14
add bridge=bridge1 interface=ether15
add bridge=bridge1 interface=ether16
add bridge=bridge1 interface=ether17
add bridge=bridge1 interface=ether18
add bridge=bridge1 interface=ether19
add bridge=bridge1 interface=ether20
add bridge=bridge1 interface=ether21
add bridge=bridge1 interface=ether22
add bridge=bridge1 interface=ether23
add bridge=bridge1 interface=ether24
add bridge=bridge1 interface=sfp1
/interface ethernet switch egress-vlan-tag
add tagged-ports=ether17,ether18,ether19,ether20,switch1-cpu vlan-id=100
add tagged-ports=ether17,ether18,ether19,ether20,switch1-cpu vlan-id=200
add tagged-ports=ether17,ether18,ether19,ether20,switch1-cpu vlan-id=300
/interface ethernet switch ingress-vlan-translation
add new-customer-vid=100 ports="ether1,ether2,ether3,ether4,ether5,ether6,ether7
add new-customer-vid=200 ports=ether21,ether22
add new-customer-vid=300 ports=ether23,ether24
/interface ethernet switch vlan
add ports=ether17,ether18,ether19,ether20,ether21,ether22 vlan-id=200
add ports=ether17,ether18,ether19,ether20,ether23,ether24 vlan-id=300
add address=192.168.250.20/24 interface=vlan100 network=192.168.250.0
add distance=1 gateway=192.168.250.1