If the switch supports VLANs, then the connection scheme you mention will work.

The key is to place the switch port used by the modem and the switch port used by the WAN port of the main EERO (i.e. the one acting as the router) on the same VLAN, and no other ports on the switch can be on that VLAN.

The VLAN is necessary to prevent a device on the LAN from snagging the one public IP address that the modem is prepared to issue.