@RobbieTT
Be aware that I am not at all saying that a user can directly access the ISP-node, but I am sure that PPOE interface can !!
Whats ever I it helps, I am absolutely OK to activate PPOE debug logging for a short period!
Note that my actual config is like this
ISP => ISP-fiber-interface => one of my small switches => pfSense.
Internet should arrive via VLAN 6, IPTV via VLAN4 and (Old) VoIP via VLAN7.
Untagged routed to vlan1 and vlans (internet) are routed to pfSense.
I did add vlan1 to be quite sure that even untagged messages are passing to pfSense. Normally I would simply have blocked untagged. However the PPPOE is assigned to VLAN6.