NAT is implemented on a firewall, the blocking of incoming connections is a side effect and isn't even intentional (that's why UPnP exists). Since you already

NAT is implemented on a firewall, the blocking of incoming connections is a side effect and isn't even intentional (that's why UPnP exists). Since you already have a firewall you can just add a single rule that block incoming connections and that's all you actually need.