We have a tap bridge between 2 local networks. It work great except that clients from the 'other' network can use dhcp server and most important can use wan gateway of the second network which is bad. It couldn't be done just by blocking ip's cause everyone can set static ip. I'm quessing it could be done by blocking some interfaces traffic but I'm really not an expert.
tap0 is bridged with lan and wlan as br-lan