It seems to me that a more logical configuration is: modem <-> router/NAT <-> switch <-> (wifi and other stuff) Though I understand that OP wanted to save

It seems to me that a more logical configuration is: modem <-> router/NAT <-> switch <-> (wifi and other stuff) Though I understand that OP wanted to save money/cables/wall warts by using the modem's Wi-Fi AP and Ethernet switch. I tend to agree that if you are trying to slice an Ethernet switch (or network) for two networks that you don't want to be bridged together, you should probably use VLANs.