> I do not want to be a "reasonably-skilled admin" > NAT to exist which acts as a de-facto firewall

My option is you should not handle router config at all and leave it to the ISP.