Bridge mode on the ISP router is what you want. Then it just passes through the internet connection to the internal router on the edge of your network. It’s what I do with Comcast.

Doing what the OP (same result, just different software) or I posted and assigning certificates to secure your local services means you can avoid the HTTPS warning that major browsers will pop up on an unsecure (HTTP) connection. Instead of going to an internal dns name without a certificate or direct to the ip…you assign a wildcard certificate to a domain name you’ve setup on your local dns. You then access that service via the HTTPS protected Domain name, with no warning.

I used Techno Tim’s guide on how to do essentially the same thing with different tools: Cloudflare, Let’s Encrypt, Traefik, and PiHole (for my DNS)
https://www.youtube.com/watch?v=liV3c9m_OX8
https://docs.technotim.live/posts/traefik-portainer-ssl/