It looks from documentation that for standard VLAN operation you need to set VLAN Type to "strict" instead of just "enabled".
If you set VLAN Type on port to "enabled" it will pass ANY VLAN that has been defined on ANY port.
The value that only lets pass the VLANs that has been defined for the SPECIFIC port is "strict" (that is, what you would expect on 99% of switches).
Documentation
https://wiki.mikrotik.com/wiki/SwOS/CSS ... _and_VLANs
Example with does not use "strict".
https://wiki.mikrotik.com/wiki/SWOS/CSS326-VLAN-Example
So does the example need to be corrected to use "strict" instead of "enabled"?
Why is so complicated to get VLANs right on SwOS?
There should only exist 3 cases: Trunk, Hybrid (with a PVID), and Access. It should not be that hard.