put a pfsense box between the modem and your local network. they will no longer have access. ideally bridge the modem if possible. if you do buy a modem(with or without router) be sure its compatible with your isp. note the isp will always have a backdoor into the modem, as they will update it as firmware becomes available. they may not have access to a third party modem, that im not sure on.
Does you isp allows you to buy and use your own modem? Or is this purely about just your router? Because allot of isps dont exally allow people to use their own modems on the network. In that case you can swith your current isp modem router into bridge mode, so that it becomes just a modem. Then you can use whatever router you prefer for your internal networking.
Well basiclly your isp can switch your modem into bridge mode if you want. Or lets say, if there is no possible way to do it from its web interface. The problem however is that not all isp´s are willing to do this. But if they can, then you could basiclly buy whatever home router you like, and use that for your internal networking like wifi and such. The isp modem then just functions as a dumb modem which is fine.
My ISP lets me own the hardware, so I have a coaxial modem (initially a moto surfboard but it just couldn't hang with the signal noise) > pfSense > asus ac68u in access point mode.
I highly recommend the Asus ac68u-- IMO for the money and use-case, pound for pound, its a fantastic router and they update the firmware constantly vs. netgear always in the news not fixing their issues. Now my poor ac68u is just a wifi access point, overkill. If you want to geek out, get a pfsense box and something simple for the wifi access point.
Check with your ISP, they probably will let you get a new modem but you must pick a model on their list. When you get it you must record the MAC address on the bottom of the modem and call it in to your ISP for activation.
netgear wnr2000 and cisco 871 wga k9 might be decent options too, and might not cost you as much the 2nd option (linksys wrt1900acs) at least. that said. the ones you mentioned are good to go. also, i don't think isps will have access to your modem in case of a third party router. also, i think a vpn might help you if you're that concerned about your isp.
I am no network expert but I saw a few videos that said that it seemed good, but the performance under heavy load is limited because of the mini CPU. The feature I like is it costs $150 and comes with $100 of pfSense software... so that's a thing to consider.
I don't know enough about wireless routers or pfSense servers to be suggesting any solutions though.
Most router/ap combos can operate in a AP only mode. My RT-N66U does this flawlessly. I havent used the AC68U as @Token mentioned but if its anything like my N66U its a solid performer and the firmware should be relatively similar having an AP only mode.
I also have the WRT1900ACS as my primary router, I really like it as well. I think hands down though the ASUS has been my favorite just due to its lower cost and higher performance. I've heard nothing but good from Ubiquiti though I have not used any of their stuff myself.