I'm looking to change all of my tower sites over to PPPoE from DHCP. At each tower site, there are two different IP subnets:

10.1.x.x/24 My Equipment
10.2.x.x/24 CPE DHCP addresses

I've read that it is bad practice to place an IP address on a PPPoE interface/bridge for security reasons. At one tower location, for example, I would have an access point (10.1.1.2) and the customers would be getting addresses from the PPPoE server (10.2.1.1/24). The access point doesn't have PPPoE for authentication, only static or DHCP. What would I need to setup in order to access my equipment on the PPPoE interface without compromising security? I'm assuming if I place the 10.1.1.1/24 on the bridge interface to get to my equipment, someone could just enter a static IP address on that subnet to get internet. Any guidance would be greatly appreciated.

try to use same subnet mask for all devices and activate (tick) vpn