Just a quick diagram on how to separate Management traffic on an ePMP network. The aps and CPE are in bridge mode in this setup. The Cambium CPE are in bridge mode with CNPilot routers doing PPPoE, which the ISP has control over as a managed router.
Our netonix has a tagged vlan for the management interface and an untagged vlan for the customer (PPPoE traffic).
The mikrotik router is trunked to the netonix on port 12 to complete this setup.