I applied solution from superuser.com. It worked for me
All credits to Alexey Degtyarev
Thanks to Hetzner network team also as they pointed to the solution, but I went to wrong direction trying to create second xenbr in the same network and assign VIFs to it. But It's not working because after virtual machine restart VIF number is regenerated.
In Hetzner you have two types of additional IP-addresses which you can use with a dedicated server: a single IPv4 & an IPv4 subnet. For each single IP you get a MAC-address and you must use that MAC on the network interface of a new VM instance. For each additional subnet you must setup a new network and setup routing between that network and the default network (associated with eth0) of the server.
In XenServer this can be done using Linux console:
xe network-create name-label="Additional network" name-description="46.xx.yy.zz/28"
Tip1: xapi0 bridge didn't show up on host until I assigned one of VMs to new network in Xen Center. Just tip that may save time if it happens to anyone else.
This will create a new network attached to a new bridge (xapi0 by default) in XenServer. Then assign the first usable IP-address of the network (according to it's netmask) to that bridge:
ip addr add 46.xx.yy.1/28 dev xapi0
Now you can add new VMs with autogenerated MACs attached to the newly created network instead of the default network. The traffic will be switched & routed inside XenServer.
Having that setup I got confirmation from Hetzner network team that only allowed MACs are visible on the switchport.
Tip2: You can verify there is no offending traffic on eth0 anymore from your side at host:
tcpdump -i eth0 -en|egrep -i 'mac1|mac2'
It all should be seen on xapi0 instead
tcpdump -i xapi0 -en|egrep -i 'mac1|mac2'
Where mac1,mac2 - MAC addresses reported by Hetzner as prohibited.