You're kind of hitting a few things here and unfortunately, all of these won't have much to do with pfSense.
I've personally used ATT gigapower fiber in the past and bypassed it, and used pfSense as a primary router on the ATT service. There are many guides on how to bypass the ATT equipment on dslreports forums, I would suggest starting there and getting a better understanding of what you'll need.
In my case, I had two switches. A "smart" switch with a VLAN configured on 3 ports that allowed the ATT gateway to authenticate the fiber port, and then I unplugged the ATT gateway and plugged in the WAN port of the pfSense router. This was simple but, required manual intervention if the fiber jack was ever power cycled (I keep all this stuff on a battery backup, so not an issue there). The second switch is just what you'll use for the stuff on your internal LAN, including any WiFi access points that you want to add in.
Some people have gone to great lengths to extract the ATT certificate and have scripted the authentication process natively to happen if the firewall reboots or if the fiber jack reboots. This is a much slicker and automated setup but, requires a bit more effort and frankly the switch bypass method worked so well I never pursued the certificate extraction method.
I haven't had ATT fiber for a few years now so I'm not sure if they've changed anything on their more recent installs. Given the activity on the forums, it seems quite a few people are still able to get the bypass working via a number of methods. This thread should get you going: https://www.dslreports.com/forum/r32295765-AT-T-Fiber-Any-way-to-bypass-att-modem-using-ASUS-GT-AC5300~start=240
If you do decide to use the wpa_suplicant method then you may have some more pfSense specific questions that some people here may help with. But personally, I would try the switch bypass method first as it's much simpler and easier to troubleshoot if you don't have a detailed background in this stuff.
