without complicate anything, simply add rules on bridge filter:
ether1 can't communicate with ether2,
ether1 can't communicate with ether3,
ether2 can't communicate with ether1,
ether2 can't communicate with ether3,
ether3 can't communicate with ether1,
ether3 can't communicate with ether2,
is more simple than use 3 pool, 3 DHCP server, 3 NAT, etc...
assuming the bridge is called "bri-lan" and the 3 ports are called ether1, eher2 and ether3:
/interface bridge filter
add action=drop chain=forward in-bridge=bri-lan in-interface=ether1 out-bridge=bri-lan out-interface=ether2
add action=drop chain=forward in-bridge=bri-lan in-interface=ether1 out-bridge=bri-lan out-interface=ether3
add action=drop chain=forward in-bridge=bri-lan in-interface=ether2 out-bridge=bri-lan out-interface=ether1
add action=drop chain=forward in-bridge=bri-lan in-interface=ether2 out-bridge=bri-lan out-interface=ether3
add action=drop chain=forward in-bridge=bri-lan in-interface=ether3 out-bridge=bri-lan out-interface=ether1
add action=drop chain=forward in-bridge=bri-lan in-interface=ether3 out-bridge=bri-lan out-interface=ether2
if you do this not like "in this way",
Any 192.169.172.0/24 can maliciously reach 192.168.1.0/24 and 192.168.2.0/24
because all net are on same router...