Got home, so more details:
Use your ISP router for things you don't care much about - VoIP, IoT, Guest Network, TV, Game Consoles, etc. Connect a good home router to it with the right firmware and create a second network. From this network the ISP can see your router only, eventually. Port forward on the ISP router whatever you need. Your more secure devices will be behind two firewalls. You'll have access to ISP connected devices, but they won't have access to your more secure network. A proper router is RT-AX86S or better with 388 code Asuswrt firmware (coming soon) or Asuswrt-Merlin (available now). This router can do >200Mbps on OpenVPN and >300Mbps on Wireguard with selective routing and multiple clients/servers - simpler and limited on Asuswrt and way more advanced and the best you can find in home routers on Asuswrt-Merlin. What else is needed? This model is often on sale for $180.
Asus RT-AC68U V4 can be found around $120. It has Asuswrt-Merlin firmware support, modern dual-core 1.8GHz ARMv8 + AES CPU, 512MB RAM, current updated firmware, router optimized IDS/IPS from TrendMicro (simple, but good enough), IP blocker is available (Skynet), DNS blocker is available (Diversion), DNS interception is available (DNSFilter), DNS encryption (DNS-over-TLS) built-in, own DNS server if you want (Unbound), OpenVPN with 5x clients and 2x servers with advanced configurations. It has Wi-Fi as well, not the latest and greatest, but better than nothing. For typical home router duties as wired router this little guy will make Cisco 1921 want to run away, hide somewhere and recycle itself quietly.