Brian,
I think you are correct. The Comcast-supplied equipment is a combo router/modem, so the security router needs to sit behind it.
However, if you have admin access to the Comcast modem/router combo until (hopefully they provide the admin password on the bottom), you may still be able to put the security router in the Comcast modem/router's DMZ, but you would need to turn that on. I did not try this when I had the modem/router combo (I only had it a few days before replacing it with my own equipment), but Comcast support seems to think that the security router needs to be first in the chain, but it would be hard to do that with a Comcast-provided modem/router unit. Hopefully you can find a knowledgble tech person to walk you through on how do that with the modem/router combo unit.