Split two providers into different (switch) networks?

Question

Computer networks

Good day, a question arose with the division of the network, since having come to one company, it is not clear what is going on here.

What we have now:

Now hell is happening, 2 providers are coming. via PPPoE (ip speaker, perhaps in the future it will be possible to take a static ip)

ISP1 - the provider goes to a wi-fi router on which the PPPoE connection is raised. Then this Internet goes to 3 other wi-fi routers in the office, and employees sit like that. ISP2 
- goes to the wi-fi router of accountants, which also has a PPPoE connection, Then the Internet goes by wire from this router to accounting computers

Now what I want to do: 

srv1 with AD domain, dhcp, print server, antivirus update mirror and trifle.
vpn server on a virtual machine raised on srv1
srv2, data replication from 1 server, and small tasks.
srv3, for network rendering of max or fully for revit server, or somehow combine it, we'll see.
NAS server separately for backing up important data.

Of the pieces of iron for the network, what was bought (alas, there is no way to buy something in addition yet)

1. Mikrotik RB3011UiAS-RM
2. SNR-S2985G-48T
3. SNR-S2982G-24T

Task:

To divide the Internet office / accounting on Mikrotik (office employees all on isp1, bukh on its channel on isp2)

srv1 with an AD domain, it is desirable to configure dhcp for the office through it.
(It turns out that the Internet comes to Mikrotik eth1, the PPPoE connection works, goes to the eth2 port, from which it goes to srv1, there the dhcp and other settings are taken in 1 network card, and from the 2 network card it already goes to the snr 48 port switch).

dhcp for bukhs will distribute mikrotik itself.

srv1 with AD and nas (for backup) must have access to boos and their Wealan.
(for the possibility of remote assistance)

On a 48 port SNR, servers / printers / wi-fi / monitoring of UPs and something else will weigh (according to estimates, 48 ​​ports are already occupied)

On a 24 port SNR, 6 ports go to the office, as they bought more printers and a couple of PCs, 6 ports go for booms.
(12 ports remain in reserve)

On the 24th port already drove 6 ports of bukhs for the test in VLAN. Does it make sense to drive all ports from 48 SNRs and the remaining 6 ports from 24 SNRs into a single vlan for the office?

Perhaps, in the future, some department will need to be driven into a separate Wealan.
Someone drives office equipment, someone wi-fi, someone tries to drive servers into separate wilans
(tell me how best to do and share)

I apologize for the confusion. If I need to add something, I'll add it.

I hope you can help me scatter everything correctly with the settings and configs for my case.

Answer 1

You are being too smart. Here now there will be a number of people \u003d the number of options, it also depends heavily on the seating arrangement of staff / offices / layout of offices.
From my belfry and seating realities, I would divide it like this:
As a premise, I got more iron, albeit cheaper.
1) everything everything everything that is connected with bukhs to your subnet, to your switch. Those. computers\printers\bukhov server.
2) a separate network for other servers that use all or all.
3) a separate network for wifi, separately for video surveillance.
4) a separate network "other" where all the rest.
Between all this, there is a stupid distinction between firewall rules or firewalls, ideally (that is, each network has its own piece of iron, even mikrotik).
But then again, this is my case. We have all the bukhs sitting on the same floor in 3 neighboring rooms as an example. If you have 1 office on one floor, the second one is 5 floors higher, and a couple more are randomly located, then there are definitely vlans. The main thing to remember is that the more complex the scheme, especially with vlans, the more difficult it will be to control it later, look for problems, and roll it over, especially if the people serving it change and especially do not document it. In this regard, separate subnets are much easier.

Answer 2

Alexander. My personal opinion is this.
DHCP - everything is on Mikrotik. we create several subnets, and from there we manage. On srv1 we create everything except dhcp and gateway.

srv1 with AD and nas (for backup) must have access to boos and their Wealan.
(for remote assistance)

This issue is solved by ip>routes on Mikrotik itself. accesses to pop subnets.
Nafig Vlana - overhead. just divide the networks on Mikrotik, make the necessary routes in the routes ...
let's say - from SRV and admin computers access is allowed, from other IPs it is forbidden (if you need to strictly delimit security in such a way
) you have different subnets, 2 providers - set the movement to the Internet by marking the traffic. by model - subnet 192.168.0.1 >>> marking>>> ISP1
subnet 192.168.0.2 >>> marking >>>
ISP2 with Mikrotik...

Answer 3

Configure PPPoE Client for ISP1 and for ISP2, create bridge1 and bridge2 for future subnets, add the necessary ports to them and NAT ISP1 to the first bridge, and ISP2 to the second.
DHCP server is also configured for each bridge, and if necessary, you can add vlan.