I need to set the WAN interface to a specific tagged VLAN on my HeX but have so far been unable to figure out the correct way to do this.

My ISP provides an hybrid connection where untagged traffic is CGNAT and does not get a public IP and you have to address a specific VLAN to avoid CGNAT. All I have read about VLANS seems to require bridging them but I don't think having my WAN and internal VLANS on the same bridge is a good idea.

I currently use a Unifi USG and this has a simple checkbox on the WAN connection to tag the traffic. If I was doing this on pfsense, etc. I would simply create an eth0.123 interface and set that as the WAN, assuming the correct VLAN was 123.

I would really appreciate it if someone would elighten me as to the correct way to do this, ideally preserving any hardware offload....

In RouterOS you can simply create VLAN interface:

Lets assume you have your WAN port on the hex as ether1 and the vlan ID provided by the ISP is XX.
Give ether1 a unique name on ethernet interfaces

/interface ethernet
set [ find default-name=ether1 ] name=ether1-Wanport

/interface vlan
add interface=ether1-Wanport name=vlanISP vlan-id=XX

Now depending upon how the provider is supplying your internet, poorly communicated thus far..........

a. if its simple a vlan only then, under IP DHCP client, for the interface, simply put the name of the vlan ( vlanISP )
b. if its a pppoe situation, dont use IP DHCP client instead go to the PPP menu and select pppoe client.
Give the pppoe connection a name and for interface select the name of the vlan( vlanISP)

Thank you both, I will give that a try. It is not PPPOE, just a simple ethernet connection.

Don't forget, assuming you didn't mess up the firewall, to add the vlanISP to the WAN addresslist.
Otherwise Internet won't work (while you have a public IP address assigned to this interface).