Thank you for asking this question in the support community. Based on your description, it appears you have it correct. You will simply need to transition the configuration from PPP 1 to the Ethernet port, and as you mentioned, this will include the policy-class / security zone, as well as any references in the configuration from PPP 1. The IP routing will need to be transitioned as well, which will primarily be the default-route statement that is currently pointing to the PPP 1 gateway. This will need to be changed to the gateway out the Ethernet interface, which will be provided to you by the ISP.
For failover, if you do not have the option of another router, either to act as a secondary connection, or a unit that has more than two Ethernet interfaces, then you can do the option you mentioned. Another option would be to add a switch and setup 802.1q VLAN sub-interfaces on the ADTRAN unit.
I hope that answers your questions, but please do not hesitate to reply to this post with any additional questions or information. I will be happy to help in any way I can.