You don't need "vlan filtering" (as in the tick box on a bridge) on any of the bridges the ingress filter makes sure each bridge can only see one set of traffic ... if you tick it probably still works but it will be doing nothing. All the bridge is doing is giving you a place to connect an ethernet sub-interface to a DHCP or PPPOE server.
I tried your recommended config but to no avail. Luckily the PPPoE traffic were not lost after implementing the ingress filtering but all the hotspot login pages did not appear when connecting to each assigned AP via VLAN.
Did I missed out something? Please see below my config.
/interface bridge
add name="bridge-PPPoE - Ether"
add name=bridge-VLAN-2221
add name=bridge-VLAN-2222
add name=bridge-VLAN-2223
/interface vlan
add interface="bridge-PPPoE - Ether" name=MGMT-Admin vlan-id=1
add interface="bridge-PPPoE - Ether" name=VLAN-2221 vlan-id=2221
add interface="bridge-PPPoE - Ether" name=VLAN-2222 vlan-id=2222
add interface="bridge-PPPoE - Ether" name=VLAN-2223 vlan-id=2223
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
/interface bridge port
add bridge="bridge-PPPoE - Ether" interface="ether4 OLT 1"
add bridge="bridge-PPPoE - Ether" interface="ether5-OLT 2"
add bridge=bridge-VLAN-2221 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=\
VLAN-2221 pvid=2221
add bridge=bridge-VLAN-2222 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=\
VLAN-2222 pvid=2222
add bridge=bridge-VLAN-2223 frame-types=admit-only-vlan-tagged ingress-filtering=yes interface=\
VLAN-2223 pvid=2223
add bridge="bridge-PPPoE - Ether" frame-types=admit-only-untagged-and-priority-tagged \
ingress-filtering=yes interface=MGMT-Admin
/interface bridge vlan
add bridge="bridge-PPPoE - Ether" tagged="ether4 OLT 1 - ,ether5-OLT 2" vlan-ids=2221
add bridge="bridge-PPPoE - Ether" tagged="ether4 OLT 1 - ,ether5-OLT 2" vlan-ids=2222
add bridge="bridge-PPPoE - Ether" untagged="ether4 OLT 1 - ,ether5-OLT 2" vlan-ids=1
add bridge="bridge-PPPoE - Ether" tagged="ether4 OLT 1 - ,ether5-OLT 2" vlan-ids=2223
/interface detect-internet
set detect-interface-list=all
/interface pppoe-server server
add disabled=no interface="bridge-PPPoE - Ether" service-name=MyWISP
Thank you in advance for your help.