i don’t use ubiquiti, but the only thing you need to do with your firewall to get better-than-NAT security is allow only outgoing connections/disallow incoming connections. usually on consumer routers that’s the default setting anyway or there’s a checkbox to that effect.