Sonic.net

The point would be to prevent anyone outside the house from even touching the sonic Arris router, except for Sonic itself.

Any potential intruders turned away before they even got to try funny stuff with sonic's arris router.

I am looking to use some kind of small hardware device, hosting only some kind of firewall software.

Like this:
{internet}-->{sonic}--->{my hardware firewall}--->{Arris}--->{my LAN}

What ports does sonic need my firewall to allow?

What firewall rules should I put in place for my Arris router to work as normal with Sonic's WAN?

Is the Arris device a legacy piece of equipment that you received from AT&T?

Doesn't the Arris router include a firewall already?
If you don't like it do you have to use it? or you can put your own equipment behind it either with double NAT or setting it as pass through.
The detail of your connection is not clear; we can help better if you give more details.
Is it sonic all the way or though AT&T, DSL or fiber etc.