I’ve had to do it fairly recently due to a lot of dynamic bridges and routing on the internal network vlan. I wanted to allow all traffic through the vlan from any device. However, wanted a default drop on the external interface.
At that point having a default drop on the external interface and different rules for traffic traversing VLAN's is entirely possible, in fact that is what it is designed and built to do.