Since you have assigned an IP address to br0, it effectively is the "real" network interface for your server. You can create iptables rules on your server that work equally well regardless of whether your network interface is named br0 or eth0. That is, just write your server's firewall iptables rules as though your network interface was a plain vanilla eth0 (except that it's named br0).
Don't worry about having to write your iptables rules to explicitly allow traffic to the virtual interfaces joined to bridge br0, because (and this is a key point) iptables rules cannot explicitly filter or affect traffic on the bridge. The reason is that bridges operate at the link layer (L2), and iptables operates (for the most part) on packets at higher network layers (typically L3 and L4). A mental picture that might be helpful is this: A bridge functions almost exactly like a network hub with all the bridged interfaces plugged into it.
If you want to filter traffic passing through a bridge, you should look into ebtables, but it is unlikely that you will need to. It is much more natural and convenient to simply treat the bridge as part of the networking infrastructure (i.e. like a hub or a switch), and to create an iptables firewall script for each host (whether real or VM) on the network.