Add/Swap UniFi Security Gateway (USG) to Existing Network with Another Router and Existing Controller

In Unifi Controller => Networks set an IP range DIFFERENT from your current one
On your “old” router/firewall hard code a DNS resolve for “unifi” to your Controller IP
I added: unifi.domain.website.com (our windows domain and corresponding DNS is running on a sub-domain).
You can verify this works on your domain by opening a CMD and type “ping unifi” … it should resolve now.
Connect the USG WAN port to your LAN – Controller should get a LAN IP via DHCP.
In the Controller adopt the USG
In the Controller configure WAN port to your real WAN data (static IP, whatever etc.).
Note: The Controller will show the USG forever as “Provisioning”. Wait a few minutes, then…
Replace your old firewall/router with the USG (WAN to WAN Port, LAN to LAN port)…
In Unifi Controller => Networks set the LAN IP range back to the one you desire.