Firewall v. NAT

We’ve got about 22 users and a couple of servers (one for mail) behind a router provided by our DSL provider. The machines inside the network have non-routeable addresses (192.168.1.x) and the router is configured to use NAT for user access to the Internet and reverse NAT for incoming email traffic.

My brother-in-law tells me I’ve gotta get a firewall as well. Can anyone offer any opinions on this subject? If I’ve got a router set up using NAT to only allow certain traffic, am I safe?
Thanks in advance,
Kevin