The ideal solution, as stated by
@degrub, would be having the DOCSIS modem connected directly to the incoming provider line, to preserve DOCSIS signal strength and isolate the DOCSIS and MoCA signals -- which is a growing issue with the DOCSIS 3.1 spec and beyond, as DOCSIS encroaches and then stomps on the MoCA frequency range of 1125-1675 MHz. See the following diagram depicting the frequency competition:

Absent any concern over DOCSIS 3.1 and MoCA spectrum conflicts, your solution is quite simple; it's just a matter of choosing MoCA 2.x-compatible components and getting the targeted remote locations connected to the central splitter junction.
If looking to future-proof against DOCSIS 3.1+ spectrum competition with MoCA, the question becomes how to isolate the DOCSIS and MoCA signals. The simplest solution would be to locate the cable modem and router at the central junction in the basement, allowing the modem to be direct-connected to the incoming cable line and reserving the rest of the coax plant for MoCA connectivity. If the modem can't be direct-connected to the provider feed, the next option is to determine if there's a location where two coax runs from the central junction are available, enabling the DOCSIS and MoCA isolation. (e.g. Can the provider install a new coax run for the modem direct to its Main floor location?)
edit: p.s. Note that buying a DOCSIS 3.1 modem doesn't automatically create a frequency range conflict with MoCA. The frequency range conflict will only surface if/when a provider begins
using D3.1 frequencies above 1002 MHz *and* you own a D3.1 modem. That said, even absent a provider employing frequencies above 1002 MHz, a DOCSIS 3.1 modem can become confused and unstable if it's seeing MoCA signals where it expects DOCSIS. The simple workaround for this situation (a D3.1 modem in a MoCA setup absent active D3.1 signals), is installing a separate MoCA filter directly on the D3.1 modem's coax port as a prophylactic, to prevent the MoCA signals from hitting the modem's circuitry.