Vyos allows creating MAC Groups but we don't have the option to use it in bridge firewalls yet.
The bridge firewall UI offers these options today.
vyos@router# set firewall bridge forward filter rule 1 source mac-address Possible completions: <h:h:h:h:h:h> MAC address to match !<h:h:h:h:h:h> Match everything except the specified MAC address
It'll be awesome to be able to select mac groups here(or !mac-group)