Dependent keys on Encrypt Then MAC
This is indeed best way to do it. As the final $(cbc\oplus cipher)$ encrypted by a different key even if we pass 0 messages it do not reveal any information. Previously passing on 0 messages gave encrypted cbc (which is later $\oplus$ed encrypted ($cbc\oplus cipher$) to reveal information) now as the key used is different even if the encrypted cbc (on passing 0 messages) is known it wont reveal information.

Hope this helps.