I'm curious about a situation I need to look into.

We already have a firewall doing a lot of things, like content management, based on MAC address. What it does not do is bandwidth limiting and we need to limit subnets throughput.

Is it possible to have a Mikrotik set between the network internally the firewall to do queues but that would be completely invisible to the clients and the firewall?
We have an RB750Gr2 available for setup but before I start poking and prodding I want to make sure it is possible.

Yes i've tested this.

You wont get hardware offload so you'll need a CPU that can do the work.

Bridge the 2 interfaces, make sure the bridge settings is set to 'use IP Firewall' (Note: This will change it for ALL bridges on the device), then you'll see the packets go through the firewall process and interface where you can set up packet marking and use those packet marks to limit certain IP's / subnets to different queues.

You may also need to turn off Fast Path, I cant recall, Try with then without.