What modem/router can I use as Bridge to connect to the AT&T gateway? Any recommendations?

I definitely want to go with the IP Passthrough mode. Actually, I just followed your guide for this and I realized I am getting a double NAT. The only thing I didn't really do was the firewall part. Could this be the reason why this double NAT situation could be happening? I mean I guess I can use Tplink Homeshield pro instead of ATTs firewall. But, I am not sure if this may be the problem. Also the Decos have two modes, Router mode and Acces point mode. and Right now they're set on Wifi router (Default mode). This Wifi router mode has more options such QoS and Device isolation. But the Access point one is more limited. I'll attach screenshots of this information. Thank you!

I appreciate a lot of the help I'm getting here! Tech support over the phone have never been this helpful. Thank you

I see. My Internet seems to be working really well now and It's even faster with these mesh devices. My only concern is that the service that I use for streaming games which is "Moonlight", Is giving me an error message mentioning that I have a router connected to another router. (I plugged my PC host through Ethernet cable to one of the mesh devices) I guess that's a different type of problem rather than a dobule NAT?..... Anyways,I appreciate so much your time and willingness to help. I'll check my options with the other software Moonlight soon. Nice holidays!

Check your Mesh system to see that its WAN IP address is something other than 192.168.something.something.  If you have IP Passthrough working correctly, Moonlight shouldn't be complaining about Router-behind-router.

@JefferMC  I just noticed that model Deco doesn't specifically say it has a WAN port, just two Ethernet ports, 2.5Gbps and 1Gbps.  Could that be part of the confusion?

That's about the stupidest thing I've ever seen.  It has to figure out which port is the WAN port?  What if it guesses wrong?

Actually, I take that back, sorta.  Looks like the XE75 Pro has the one 2.5Gbps port, the three on the non-pro are all 1Gbps.  I guess it works out hardware-wise since @Phobiatoslowinternet reports good performance, but I'm not sure what that game is doing caring about the connection.

Interesting. So my two kit Decos XE75 PRO don't have a WAN port? I actually called TPLink tech support, explaned the whole situation to them about ATT locking me down to their gateway and all they did was to set up the Decos as Acces points. Now it seems like I'm not getting double NAT at least not in troucert.

Specs of my deco below 

Oh, so you do have the Pro version. 

While it doesn't specifically call out the WAN port as such I don't think you'd get it configured for IP Passthrough and get the good performance you described if it wasn't doing something in software/firmware to make whatever it's connected to treat it like a WAN port.  After all, this unit is a router and designed to work with other ISP's that have gateways that can go into Bridge Mode and not need IP Passthrough.  That also requires connecting to the Deco's WAN port.

I think TP-Link just wimped out and said put it in AP Mode because that's easier for them.  They don't want to deal with walking you through AT&T's setup stuff for IP Passthrough.

As far as no "NAT", yep, that's because the Decos are just another device on your BGW network rather than being on a separate subnet. Again, you don't have double NAT in IP Passthrough mode and I suspect that had that Moonlight game not brought up that router issue, you'd be flying down the road and not looking back.

AP Mode is a perfectly acceptable alternative as long as you're aware that in AP Mode you lose some of the features TP-Link provides.  If none of the No's in the chart below matter to you, then stick with AP Mode as long as it's working well and doing what you need.

Is there a  more accurate way to double check I don’t have a double Nat? I realized that I am losing  some performance on speed by using decos on the AP mode. I’d prefer to stick to Router mode if there’s a way I can really confirm I don’t have a double IP.

I also connected with TPLink support and they had me connecting the OTN cable to their decos but obviously didn’t work… so they just had me activating AP mode on the Decos. 

In regards to IP Passthrough. I had someone from AT&Ts tech support who helped setting everything up. I didn’t really moved the firewall settings on the gateway but *Almost every guide* out there were suggesting to deactivate all firewall options on the AT&Ts modem settings.  Also, the inclusion of  the MAC address for the deco was mentioned and I believe the MAC address is set correctly to the decos but the firewall options are still activated as on default. 

The most common way to test for double NAT is to run a tracert.  But that's not a good test for a router connected behind an AT&T gateway using IP Passthrough for reasons I've outlined before.  The BGW still processes packets destined for the BGW so that's why it shows up, but again, it does not do NAT on packets being passed through which is what really matters.

You shouldn't be seeing any significant performance difference in AP mode, so that's curious.

You didn't comment on @JefferMC's suggestion to check that the TP-Link WAN (Internet) IP is the public IP (that which whatismyip.com shows you).  If it is, Passthrough is working and no double NAT (that's the other way to check, see if both the BGW and Deco show the same public IP).

Ok, connecting the ONT cable to the Deco says they have no clue about how to connect to AT&T fiber.  So in order to get you off the line they took the easy way out.

The whole firewall thing seems a bit overblown.  I have IP Passthrough running and have never disabled any of the BGW's firewall settings.  My system runs perfectly fine and I get 940/940Mbps all the time.  Since that's about all there is I'm not sure I'm giving up anything with it on.