You have a good plan. A good firewall is, as you suspect, only part of the necessary protection. The MyCloudNAS function provides a convenient way to allow access through the firewall, but does not address authentication and access control.
SS-439, Ubuntu Server 12.04.2 LTS, EXT4, RAID10, 4xHitachi 5K1000
TS-112, 3.7.3 20120801, EXT4, 1xHitachi 7K1000