Best config for unattended access point

In a few weeks I will move into a new home. The network will be like this:

Huawei 4G router that bring internet connection and wifi at home
Openwrt router in a storage room outside home.

The router i unattended and i will connect there a Nab (cable) and a Ipcam (wifi) plus mobiles phones and laptops sometimes.

Whats the best config for that router? It has to be pingable fron huawei principle network but it has also to filters mac adresses because it's unattended and i don't want someone to plug a cable and enter my network.
Suggestions? Thanks!

What is the cyber warfare capabilities of your enemies?
Mac address filtering isn’t really a security thing. More like an internal network address function that can fix IP addresses to known devices that you what to have on specific locations in the network.

But if you give me physical access to your device you can set it up any way you want with humongous big password etc. I just connect through the serial port instead and change the configs so I get in to the network you have.

No powerful enemies, only desire to keep the network secure against casual attackers with a laptop and a lan cable.
I have on the network my nas (secured as far as i can do), a backup line for the security system of the house, and some other systems.
I wants only not to do some easy mistakes