question about blocking ports in W2K

[Lists]

Just a question for all your experts out there, how safe is it to close all 
ports and only open the ones necessary on a W2K server with a public ip 
address and no firewall in between?
And how much security would I gain by putting a little router in between, 
give the server a private address and use NAT?
What device would you recommend? netscreen? sonicwall? any other vendor?

thanks, Daniel