Well, if you have the option you could set up a virtual network through the VPS and have a box with pfsense or something to route all traffic through. Take this with a grain of salt - I’ve seen this done but never done it fully myself.

Basically yeah, though I didn’t specify hardware because of how often virtualization is done now

I mean if you’re hosting anything publicly, you really should have a dedicated firewall