It comes down to addressing and the subnet mask.
Run the main eithernet to the Belkin router's wan port and then run a cable from the Belkin to the Time Capsule's wan port. You can set the Time Capsule to only allow certain MAC addresses to connect as I remember. The Belkin should be on a certain subnet (say 10.100.100.x) and the Time Capsule should be setup for a 'New Network' and work on a different subnet like say 10.100.200.x. You could also set the Time Capsule up with another IP address range too if you wanted (like 192.168.x.x). It can use NAT and DHCP to handle access and addressing.
This kind of thing is done all the time... You do not want to bridge the connection as you would lose control on who/what connects.
A separate network needs a distinct networking address scheme and DHCP to make it easier to maintain. Then with NAT (Network Address Translation) the actual connection to the internet is managed. The Belkin provides an address to the Time Capsule and supports NAT-ing the internet connection conneting to it and the Time Capsule provides addresses to the devices that connect to it and provides NAT-ing to connect through it to the Belkin. They have to have a dissimilar enough network address scheme to avoid overlap. If you connect the Time Capsule to the Belkin through the Time Capsule's lan port, things aren't going to work like you want it to and it's a common mistake. Clear as mud?