We work with this the other way around, management via main routing table and customer traffic in VRFs. We drink our own Kool-Aid though, so our own offices have routers where our traffic is in a VRF and we subsequently didn't have access to routers from within our own network.
The following rules essentially mark new connections arriving from rfc1918 sources (address list 'local'), towards any IP local to the router (dst-address-type=local (NOT the address list)) and then NATs those connections to the loopback IP in the main routing table (192.168.254.1). The result is that one can then connect to any of the router's IP addresses from within a VRF.
The VRF is called 'mpls' in this example, output mangle rule essentially marks routing for packets associated with a connection mark of 'mpls' to the VRF routing table.
/ip firewall address-list
add address=10.0.0.0/8 list=local
add address=172.16.0.0/12 list=local
add address=192.168.0.0/16 list=local
/ip firewall mangle
add action=mark-connection chain=prerouting comment=\
"Policy based routing - MPLS - from 'local' address list to router's IP:" connection-mark=no-mark \
connection-state=new dst-address-type=local new-connection-mark=mpls passthrough=yes src-address-list=local
add action=mark-routing chain=output connection-mark=mpls dst-address-list=local new-routing-mark=mpls passthrough=no
/ip firewall nat
add action=dst-nat chain=dstnat comment="Redirect - Management connections from within VRF:" connection-mark=mpls to-addresses=192.168.254.1