whups, I see you said "transparent bridge mode". I now think you mean literally then it's not touching the packets, not a transparent proxy. I guess the "bridge" part would be a clue...
sorry about that, i need to stop posting at midnight.
I'm generally not fond of completely transparent inspections systems, it's possible to fool them by making headers cross packet boundaries or by finding other holes in the stream reconstruction process used by the transparent device, allowing bad stuff to slip through.
That critique aside, the previously reply is probably the right way to go (seperate vlans). This avoids bridge loops.
must.go.to.bed.now.
Paul
Nimbostratus