Port forwarding through a three router Y setup

I'm finally jumping in over Christmas break to set up a Y network with three routers. I run a side business repairing and cleaning viruses/malware from PCs and would like the business subnet not to be able to mix with (and possibly infect) the "home" subnet.

Before I knew what I was doing, I set up a simple two router "chained" network by hanging an old SMC router off my main Airport Extreme router, but I've since learned that's not ideal, since the "work" network machines can see everything on the "home" network.

So, here's what I want to do. I want to put the new third router right after my cable modem (ISP). I want to keep my Airport Extreme and all devices attaching to it (home subnet) off one LAN port of this new router and my old SMC router off another LAN port of the new router (the test subnet). Currently, the IPs are:

new router: 192.168.2.1 (not setup yet)
Airport Extreme: 192.168.11.1 (currently connected to cable modem - so WAN side goes to the Internet now)
SMC Router: 192.168.1.1 (currently WAN side connected to LAN side of Airport Extreme 192.168.11.x)

My concern in setting up a "Y" configuration is that I have some wireless IP webcams on the Airport Extreme that are using port forwarding (both UDP and HTTP) so I can view them from wherever I am on the Internet, not just from within my home network.

What's the best way to make sure the port forwarding from devices on the Airport Extreme subnet works through the "new" router and out through to the Internet? Do I have to open the same ports on the new router? If so, does anyone have an example using the addresses above? Should I just put the Airport Extreme in the DMZ of the new router (so everything is just passed through - or will that allow my test subnet to see the home subnet? Some other way?

Any help would be appreciated....and Happy Holidays all.