Using wireguard on AR300M16 (ext) via access point

I have a “shadow” (AR300M16) sitting behind a Vigor 2860 , which does all my NATTINg , firewall etc. So I want my AR300M to act as an access point only (no NAT, Firewall etc) however if I do this (with stock firmware) I loose the options to configure a VPN. I’d also like to allow a Wireguard server to run but obviously don’t want to suffer a double NAT.

I sent a mail to GL and was told “NO, butwe’re working on it”

Is it as simple as running in “router mode” but turning off masquerading?

According to your description, you need to set the router to bridge mode, but wireguard does not support bridge mode.