How to protect confidentiality and integrity?
Limit who you trust; encrypt everything.
Obviously, don't install any CA certificate imposed by the ISP. Consider removing certificates that are controlled by parties you do not trust.
At a minimum, make sure HTTPS is used for everything; you could even block traffic to port 80 and other HTTP ports to ensure nothing is leaked. Even with HTTPS, the ISP can still see the hostnames of the site you are visiting, thanks to SNI, if using TLS < 1.3 without ESNI. To mitigate this, only use TLS 1.3, and/or use a browser that supports ESNI. Problem is, not all websites may support these technologies.
The other major threat is DNS. DNS reveals just as much as SNI, but it also has no guarantee of integrity. Even if you change your DNS provider to something outside of your ISP, your ISP could theoretically redirect your DNS queries to their own servers and modify the traffic without any way to detect it. There are several replacements for DNS which attempt to mitigate the confidentiality and integrity problems, notable of which are DNS-over-HTTPS (DoH), DNS-over-TLS (DoT), dnscrypt, and dnscurve (note DNSSEC is not listed; it does not solve the problem of confidentiality). These protocols are all incompatible with each other and have varying degrees of standardization; it appears that DoH and DoT have gained the most traction. Various big-names have started promoting these protocols and have started offering them within browsers and mobile operating systems. These protocols can either be enabled individually on each device in the network, or configured on the router so that all devices speak normal DNS to the router, which then proxies the request using DoH or DoT.
But the above may not cover everything you do. To ensure more complete safety, use something that can tunnel all of your traffic, such as a VPN*, IPsec, or Tor (as written in the other answer, the ISP may have blacklisted known Tor nodes, so you may need to choose an entry node manually). Ensure that wherever the tunnel ends, it is beyond the reach of your ISP (e.g. don't set up a VPN tunnel to a friend's house that uses the same ISP), and it with a party that you trust (relatively). This depends on your exact threat model, so "free-VPN-that-collects-and-logs-all-your-traffic" may be acceptable compared to an ISP that is actively hostile.
If you own and control your own router (preferred anyway), you may be able to configure it as a VPN client such that all devices on your network will automatically use the VPN. If you do not control your router (i.e. ISP owned), connecting to a VPN from each device on the network will mostly mitigate the threat of the router.
*Most modern VPN providers and software will have pretty safe defaults, but VPNs can be configured without encryption as well, so don't automatically assume they are equivalent in all possible scenarios.
How to evade detection of these methods by the ISP?
This is definitely a hard problem, as it is fairly trivial to analyze network traffic. That is, changing the port you use for a protocol may not fool anyone (unless the traffic is encrypted and unrecognizable, and on a port that normally has such traffic). So, tunneling all of your traffic over a VPN on UDP port 53 may defeat some basic firewall rules, but deep packet inspection (DPI) will immediately raise red flags; port 53 is usually for DNS, which is a well defined protocol. Your traffic won't look like this at all.
Likely, the best option is to choose a port such as TCP 443. Still, it may be possible to profile the traffic and determine that it is not purely web traffic, with a decent degree of certainty, but it may not raise too many red flags since most internet traffic is probably over 443 anyway.
There are also ways to tunnel IP traffic over standardized, plaintext protocols such as HTTP, DNS (iodine), carrier pigeon, and ICMP (icmptx). While I do not think these may solve the problem (in fact, they could bring more attention to your traffic), they are interesting and perhaps relevant. I suppose there could be a scenario where your ISP forces you to use plaintext protocols that they can enforce and inspect with DPI. A VPN could be used to tunnel all traffic over another protocol while still conforming to the outer protocol's standards, thus evading the restrictions.
Summary
Require HTTPS and secure DNS
If this prevents your availability, e.g. the ISP forces HTTPS traffic to a proxy, use a VPN or Tor with manual entry nodes. The VPN may take some research or experimentation to get working; perhaps there are ports or protocols that are overlooked. E.g. perhaps TCP traffic is bent toward the proxy, but UDP is overlooked or mistakenly routed anyway (possibly only certain ports), but this is only a hypothetical misconfiguration
If all else fails, use application-layer encapsulation as a last resort. HTTP/DNS tunnels often still work behind proxies and forwarders, and may allow your traffic to pass through since it matches an allowed, cleartext protocol (but obviously your data would be encrypted). There may be some severe performance penalties to this method, but it can get you out of many a tricky scenario. This is not foolproof, it will still stand out and could be signatured.
Adapt to whatever they throw at you
