You need basically the exact same stateful firewall you already need with IPv4 even with NAT, except that with IPv6 you need to allow ICMP as well otherwise pat

You need basically the exact same stateful firewall you already need with IPv4 even with NAT, except that with IPv6 you need to allow ICMP as well otherwise path MTU can break. On the in chain - allow ICMP, allow established/related, block otherwise. Open up any additional ports as needed, just the same as you used to do with port forwarding before. All routers, even crappy consumer ones should have a basic stateful firewall on by default. Hopefully with sane default settings.