Each MX needs to have a unique address, and must be able to talk to the Internet. You could get a second /30 circuit from the ISP and plug that in. This will protect outbound web browsing and AutoVPN but wont protect inbound NAT.
You will want WAN2 on both MX units to connect to the same MPLS router. You may need to use your switch to do this by creating a VLAN with 3 access ports in it, and putting the two WAN2 ports in it and the MPLS router.