You don't need a switch between the cable/dsl modem and the router. Just string one router after the other. Go from the modem to the customer router, and then plug the internal router into a port on the customer router. From the point of view of the internal roter, the customer router is part of the wild, wild Internet, and not to be trusted. If you set up different IP ranges (192.168.0.x vs 192.168.1.x) you can even log in to administer the customer router from a computer within the internal network.
Routers are so cheap that I've done that at my house. That way, if one of my friends has a virus on their system that goes looking for a machine on the internal network I'll be protected from it while still giving them access to the 'Net.