Connecting 2 buildings

Assuming that if your are using layer 3 switch connected as main core switch and all VLANS are configured in that switch then you can have fiber connectivity from core switch if you switch don't have SFP port compatibility use media converters and connect as access port and allow specific VLAN and connect to another layer 2 switch in another building if another building are using multiple VLANS traffic mean allow trunk Port .. In this way both building can use single firewall which is deployed in main building connecting to core switch if your core layer 3 is not compatible with or equipped with SFP port then use fiber modules or media converters...this connectivity allow you to use same firewall for both building traffic and it is easy for monitoring and management .

please refer below diagram for overview topology for this requirement

For the main building I've placed a firewall just before the router

Based on your drawing, you've placed the firewall after the router, in other words the firewall does not protect the router itself but rather sits downstream from it.

There's not necessarily anything wrong with that, except it means that the uplink from Building 1 to your main building will not be protected by the existing firewall if it is connected to the router in the main building.

Using two firewalls for your situation would introduce unnecessary complexity, cost, and management in my opinion. Instead, think about connecting Building 1 to the existing building by either interconnecting either the two routers together with the firewall placed outside of the router in Building 2 or alternately, connecting the two "main" switches together. In either of those scenarios, both buildings' networks will be protected from the internet by the existing firewall.

I assuming that you are in one single network and two separate vlan on separate building. Therefore you don't have a requirement of two firewalls. If your main switch has Layer 3 facility, You can make a connection between main switch to main switch. It is not a good idea to provide direct internet connection to core(main) switch at all.

You have two main switches and if it has facility you can enable VSS and can work as a one single switch. Then there is no special routing is needed for second switch.

Always keep your network behind the firewall.It is necessary.

If you want be separate from network1 and network2 you can make connection from firewall to main switch in building 01.