Actually all it takes is a firewall. As far as hiding hosts goes, a firewall is just as good as NAT. And then if you do need a host or two accessible, the firewall is easier to change than the NAT.