Passing the PCI device is the correct way to do it, but you can also try making a second bridge (say, vmbr1) and adding your other physical interface to that. Then configure your firewall VM with two virtual NICs, one joining each bridge.

I have it like that
eth1 -> vmbr0
eth2 -> vmbr1

openwrt then uses
vmbr0 as WAN
wmbr1 as LAN

problem is that Proxmox is asking ISP for IP on eth1 with its real MAC address
and Openwrt is asking ISP for IP on vmbr0 with its static random MAC address passed when adding bridge to VM

the last part is the problematic one. 2 different MAC addresses asking for IP from ISP

I used to passthrough dedicated NICs to my VM firewall (pfsense) but instead have moved to dedicated bridges and VLAN tagging as this allows me to have that VM migrate to any of my other hosts without issue. On the other side of the connections to the ProxmoxVE nodes there is a switch and my modem is connected to it and is on a dedicated VLAN that is only accessed by the firewall VM.

I haven’t tried it yet but you can map hardware resources at the cluster level and still do live migrations with PCIe passthrough.

You can set the MAC address for a bridge.

For the iface vmbr0 inet entry in /etc/network/interfaces, just add "hwaddress ether XX:XX:XX:XX:XX:XX" for the mac address you want it to be.