For what its worth, I too have ATT with a BGW320.
I can confirm that I had zero issues with Alta’s cloud based control even before migrating over to Alta’s on-site controller.
Under Firewall settings, I currently have IP-Passthrough mode configured to DHCPS-Fixed, with the Passthrough Fixed Mac Address set to my Alta Route10’s MAC on the drop down list.
All of my Firewall Advanced options are set to off.
Packet Filter is disabled.
Additionally I’ve shut off all ipv6 functionality under Home Network, IPV6 tab.
Log into your ATT account on ATT’s website, head over to your profile/privacy choices/DNS Error Assist, and set that to OFF. Save settings.
Power cycle your BGW and Route10.
Unfortunately the only work around for the double NAT would be to attain a static IP block through ATT.