To a certain extent, NAT is a type of firewall. If you don’t forward any ports in, and don’t allow remote access or administration, then your internal network is unreachable from the public internet. This is how basically every consumer router has functioned for a long while.

You can get more expensive systems that offer further firewall and intrusion detection, but they cost more money and require more knowledge to properly secure and administer.

With either hardware setup, you should keep up with firmware updates to patch exploits and make sure you monitor the vendor in case the hardware becomes permanently compromised.

EDIT: I should add, if your computer is compromised by a virus or something, then a firewall won’t necessarily stop that. Most firewalls are focused on blocking inbound connections. While you could technically block outbound countries and ranges with a better firewall capability, once they’re in, that’s kinda game over. In that case an IDS/IPS system might help, but really just being aware of what you’re doing and running, as well as running a modern AV software, will go a lot farther than trying to set up a hardware firewall appliance.

EDIT2: and yes, I’m just talking perimeter network firewall stuff. As others are saying, but shouldn’t have to, you should be running the firewall included with your OS as well. You could segment by VLAN as well, but that gets into more advanced topologies that may not be needed in your setup.