I don’t use openwrt, but on linux i can say it is easy.
Since the switch uses Distributed Switch Architecture (DSA) you can use any port on the switch, as if it is a port on the soc. On hardware level the lan and wan ports are the same
In your case, just do not add the lan ports to any bridge. Then basically the lan ports (and 1 of the SFP) are the same as the wan port. Add IP to any of those ports, as you can with.the wan port