of the Ethernet ports on the LAN side of your router. Connect the switch to an available port on the router. You router is already a firewall to the WAN side. If you wanted an additional one, you'd connect it from the router to the switch and all devices you wanted the additional firewall protection for would connect to the switch and not a router port. Anything that currently works on your LAN now won't be affected by adding a switch moving devices from the router ports to it.
Where exactly would you add a switch on my network? Dedicated firewall?
I believe: cable modem -> firewall -> switch
If my server is connected to the switch, it can still let me RDP to upstairs thin client from upstairs computer, right?