Can I connect the internet fiber to the CRS328 (who has 4 SFP+ ports) and configure the RB4011 to use that as default destination?
This would however mean that all traffic from LAN to WAN has to go through the CRS328 - RB4011 connection to be routed and back to go to the internet.
Assuming internet comes without VLAN tags, you configure WAN port on CRS as access port of a VLAN (e.g. VLAN ID 100). Then use another VLAN ID for LAN (e.g. 200). The interconnect between RB4011 and CRS will be all-tagged (trunk) port for VLANs 100 and 200. The rest of CRS ports will be access ports for LAN (VLAN ID 200). If ISP provides internet via VLAN taged, you proceed in similar manner, the difference is that you can't choose VLAN ID for WAN (and you possibly have to select another VLAN ID for LAN) and you make WAN port on CRS to be all-tagged port for that particular VLAN.
As to configuration on RB4011 it depends whether you want to use ether ports as LAN ports or they won't be used at all. As RB4011 doesn't HW offload VLAN stuff, it would best be to forget about ether ports on RB4011 because traffic between those and LAN ports on CRS will hit RB4011 CPU. So if you'll use only SFP+ port on RB4011, take it out of any bridge, create VLAN interfaces (
/interface vlan ...) for both VLANs (100 and 200), configure IP settings on each of vlan interfaces, make them members of interface lists WAN and LAN ... and if you stick to default firewall configuration, this should be enough to get you going. From RB4011 default there will be some redundant configuration (bridge setup and related IP setup) which should be reviewed and partly removed.
Your wording ("configure the RB4011 to use that as default destination") indicates that you think you should configure CRS as a kind of a router. Don't even think about it, it'll kill all the performance. Keep using it as VLAN-aware switch in manner outlined above.