So with "from behind pfSense" you mean that the Proxmox web gui is filtered by firewall rules etc.?
Because I think thats not directly possible in with "just" 3 Linux Bridges, but you could create another "virtual only" net/Linux Bridge that is just not connected to a physical port, like so...