to 1)
If I configure the modem/router as a bridge the device is accessible directly from the internet. I don't see any different is the risk that someone hack the modem/router.
To 2)
This sounds good. This would be the proposed setup of @Renan_Azedo_de_Olive but with a fix IP address on the RED network from NS to the modem/router as @robb mentioned.
Is it possible to use the same computer with NS also as a storage server with e.g ownCloud?
Would you recommend to have virtual machines toe separate the different jobs (firewall, gateway, storage, etc)?