Yes, it is all possible.
If you utilise, oh, lets say ethernet0/0 (normally untrusted) for the "onward" connectivity, then you can select subinterfaces for that interface.
So, let's say you use the following:-
ethernet0/0.1 as a subinterface, then your actual connection will be on ethernet0/0, but you will be utilising the subinterface of ethernet0/0.1 virtually, if that makes sense. So your physical interface will be ethernet0/0 (where you will attach the rj45 connection, but the virtual interface will be ethernet0/0.1, and there you will assign ip address etc etc. The most important point here is that your onward device (next hop device) will be pointing at the subinterface address, not a physical address as that port (ethernet0/0) is unlikely to have an address assigned to it.
It works very similar to a router on a stick.