It works using that way
Which way? Pure switch or a router with additional routing tables chosen using routing rules depending on input interface and destination?
It doesn't matter whether the CRS must act as a router towards internet or towards some other set of addresses or subnets, we have to accept as a fact that the CRS has to be a router. So the question is what is the routing table on the devices connected to the VLANs, and whether the pfSense has an address in each of the subnets that live in this VLAN.
The device connected to the CRS obtains a MAC address of the gateway; if you use bridge filter to prevent frames carrying packets with destination IP addresses of the other VLAN subnet from reaching the IP stack of the Mikrotik, these frames will simply not get anywhere because the pfSense has another MAC address. So you would instead have to use
/interface bridge nat rules to rewrite the destination MAC address of these frames. But the solution with routing rules should be better - if the pfSense does have an address in each VLAN/subnet, the CRS will send ICMP redirects to the devices if they send a packet for the other VLAN subnet. If it is connected using some other subnet, the CRS will just forward the traffic to the pfSense.