This depends on how you would like to set up the CUJO - DHCP Server Mode or Bridge Mode.
In DHCP Server Mode, you need to connect a cable just to Cujo's bottom port (Marked with a number 1) to your main router that's in charge of the networks DHCP Server. Connecting the CUJO to a Switch that's connected to the main router is valid as well.
In Bridge mode, you need to connect CUJO's bottom port in much the same way but afterwards you must connect to top port to an Access Point or Switch. Once this is done there should no longer be a direct connection between the Main Router and the Access Point or Switch. In this configuration, devices that connect through the Access Point or Switch will be protected but if a device were to connect to the main router directly, CUJO would not see this and will not be able to protect this traffic.