What I did is I configured the modem to use the 192.168.100.0/8 network, then I configured two VLANs on the red WAN port, VLaN7 and VLAN2, let's call these red.7 and red.2. Then I bridged red.7 to dsl0.7. And added red.2 to br-lan.
On the PPPoE router I configured PPPoE to use eth2.7 (eth2 being that router's wan interface) and added another interface eth2.2 with a static address (192.168.100.2) and added that to the WAN zone. And now I can access the HH5A's GUI from my internal network simply by browsing to:
http://192.168.100.1.
I think this set-up meets your "fairly secure way" criterion....