So the only difference between bridge and passthrough is that with passthrough the device is still reachable from the internet?
That is correct.
In passthrough/bridge mode public IP of RUTX50 mobile interface will be passed to one of your firewall's network interfaces. The router itself will become transparent, unless the aforementioned port forwards are configured to reach the router over public IP. Otherwise all traffic will go directly to the firewall.
Router's LAN interface must have DHCP server configured, but this comes with default configuration. You can check it in RUTX50 WebUI Network -> Interfaces -> [lan settings] page. The port of your firewall, connected to the RUTX50 should be DHCP client. That's it.
Best regards,