I would move the peering routers to a virtual router routing instance.
then you can use one subinterface on the DPI device to receive traffic from the upstream with the second to send the inspected traffic back to the master or root routing instance where the downstream clients remain connected.
You will need to setup routing between the two routing instances to forward the traffic. A bgp peer between them should do what you need.