Firewall client; with or without NAT?

It is not very simple to answer as many people confuse firewall with mapping "fake" IP addresses to real ones. For example Proxy Server although it offers some firewall services is NOT a firewall (the new ICA is).
Of course you will always have at least one Ip exposed (in both cases: firewall or NAT). You don't have to use the NAT if you don't want to. The only way the Proxy or NAT are helping is that they are hiding the network machines from the Internet users (the server running these services maps all the real IPs to your internal IPs. The external Web sites that are accessed by the computer that are using private IPs (192.168.x.x) are going to record one of the real IPs from the rage defined on the NAT.
Since this is a very large topic, and your needs might be very specific, I suggest that you browse the TechNet for tips and also the Microsoft site for some white pages on recommendations about how to set up a firewall in conjunction with NAT.

Thank you for writing with punctuation signs and capital letters (I'm not ironic :-)

It depends on what firewall you choose. Most firewalls allow you to either use NAT or to have routeable addresses behind the firewall, or some combination of the two.

If you do have routeable addresses (no NAT), then your internal computers can be accessed from the internet if the rules in the firewall allow. Your ISP will have to be specifically told about the public addresses you are using behind your firewall unless they are providing the addresses, so that they can do the routing properly.

If you do use NAT, the computers behind the firewall are hidden, but you can instruct the firewall to pass traffic addressed to the firewall on certain ports to a specific computer. For example, you would list your firewall address as www.yourdomain.com, but tell the firewall that all traffic on port 80 (for http) should really go to your real web server, with a 192.168.x.y address. Similarly, traffic for port 25 (SMTP) would go to your mail server.

In either case, you would set your firewall rules for each box to allow only the ports and protocols you specify from external sources, and you would limit traffic from each box to only certain protocols and ports. (For example you might wish to block NNTP or ICQ traffic to certain computers.)

Hope this helps.