This is one of the reasons I never went with a provider like SADV. The lock down of the router introduces so many problems. Just be aware that if you place another router behind the 813G you will most likely run into double-NAT issues.
If they do not allow you access to the Calix, I would suggest that you get them to turn off firewall, WiFi, DHCP etc. Then get them to configure your router to be in the DMZ (you can only place one IP into the DMZ) - this will essentially open up all traffic to that device, which will then handle firewall and other stuff. This all is still very messy as you will have zero-insight what is configured on your device.
I have doubt that UPNP will actually properly work - technically UPNP should broadcast from the edge device (the Calix) but in this case it would route into a DMZ device and I somehow don't think routing will work.
At the best case I would require screenshots of all configurations - I have uploaded the 844G user-guide (which is essentially the same as the 813G) -
https://drive.google.com/open?id=0B1gLjV72pMhRTlU3RWZ5UjVBNEk