Either way, the router should be the gateway device for the LAN and WAN and not the NAT router connected to the computer with the computer being the gateway device.
If done properly, the NAT router will be a standalone device that protects the machines behind it on the LAN. Since it is a standalone border device that stops unsolicited scans and attacks, it cannot be taken down or attacked like the O/S and ZA with ZA having the possibility of it being taken down exposing the computer.
If you have a USB modem, then you should have the ISP provide a modem with the RJ45 jack connection so that the modem is plugged into the WAN port of the NAT router and all computers are connected to LAN ports on the NAT router.
If you have to buy a modem that has the RJ45 jack connection, then make sure it's a modem on the ISP'S approved modem list.
You should bring the all machines behind the protection of the NAT router. You can still use ZA on the machine to supplement the router to stop outbound if need be, since the router cannot stop outbound.