It should be doable in SwOS, but I don't have any experience with it what so ever. It should be doable in ROS as well ... something like this:
/interface bridge
add name=bridge vlan-filtering=yes
/interface bridge port
add bridge=bridge interface=ether1 ingress-filtering=yes [pvid=N]
add bridge=bridge interface=ether2 ingress-filtering=yes [pvid=N]
add bridge=bridge interface=ether3 ingress-filtering=yes [pvid=N]
...
/interface bridge vlan
add bridge=bridge tagged=ether1,ether2,ether3 vlan-ids=<VoIP VLAN ID>
[ add bridge=bridge untagged=ether1,ether2,ether3 vlan-ids=N ]
In the example above I included some optional properties/commands written inside square brackets []. The behaviour you want (hybrid ports, VoIP tagged and the rest untagged) can be obtained without the optional parts. However I'm firm believer in
all-tagged approach ... which means that if there's some tagged traffic handled by switch, then all of it should be tagged
inside the switch. This approach also allows to segment the switch into two (or more) untagged logical switches ... i.e. untagged ports, belonging to different (internal) VLANs, don't communicate between each other.
Note that the above code is quite incomplete ... there are other properties to be set on bridge (e.g.
frame-types=admit-only-vlan-tagged if switch is set up as all-tagged) and one has to take care about management access to the device itself.
Note2: only single bridge per device can be fully HW-offloaded. So in reality one should adapt settings of existing bridge rather than create another one for a few specific ports.