You are using a regular Incus bridge (incusbr0), so firewalling can only apply to traffic in and out of that bridge, not traffic between the members of the bridge.
There is an attempt at changing that here: Support for ACLs for bridge NIC device when using nftables driver. by mikerobski · Pull Request #1225 · lxc/incus · GitHub
But until that gets reviewed, tweaked and merged, you can only do micro-segmentation through OVN.