@imikem 

The ideal networking gear settings is those that work for you.

Three ways to connect Deco running in router mode to ISP modem/router. 

1. Just connect Main Deco to ISP router. Unless you have devices or apps that will suffer from double NAT, that may be the safest way to do. Your network will be protected by ISP router firewall and by Deco firewall, a hacker will have to penetrate them both to cause damage.

2. Configure ISP router in bridge mode and connect Main Deco to it. This is the most kosher implementation, but some ISP routers have quite convoluted process of switching them to bridge mode. If later you have to rollback that, for example you've found Deco does not meet your expectations and you'll be returning it, you may need to go through another convoluted process of switching ISP router back to original configuration.

3. Put Main Deco in DMZ like you did. Honestly, I never thought of it, that is nice idea. It combines "no double NAT" plus easy network configuration rollback.

If I were deploying Main Deco in router mode in home network, I would start with connecting Main Deco to ISP router and doing nothing else. Except turning off router WiFi, of course.

If I find I need to deal with double NAT, before your post I would have tried to configure ISP router in bridge mode. But, now, I'll be puting Main Deco in DMZ. Only if that does not work, I'll switch ISP router to bridge mode.

Personal preferences, of course.