Short answer: Get another ISP.
Of course, you shouldn't trust your ISP with granting them uncontrolled access to your business network in any case, but that may depend on your security requirements. Usually, you put your own router/firewall between your ISP's router and your network. Whether the ISP's CPE is in routed mode, bridged mode or even present at all doesn't really matter securitywise (it does matter for functionality, performance and management though).
While your ISP is always located in between your network and any other service you use on the Internet (whether you use their router or not), as long as your communication is properly encrypted (TLS, IPsec) they can't do anything more than disrupt your traffic.
However, connecting the ISP router to your network directly requires a high level of trust. Direct connection enables access to non-public services, manipulations on the data link layer and potentially a large array of snooping and spoofing techniques. You should decide on this level of service (see IaaS, SECaaS) very consciously, do not take it lightly.
In any case, you might want to set up secure DNS (DNSSEC) if you don't trust your ISP with insecure DNS. Note that protocols above the transport layer are explicitly off-topic here, so you might want to ask about this on Server Fault.