You should use one of your PDs as a DMZ not putting your externally exposed web server in the same subnet as your IOT or other outbound only devices. If you're hosting a lot of things™ you should be using a static DMZ, same as you would on IPv4.

For the more general user case ("I want to host a game session with my friend") I'm not sure if there is something like UPnP for dynamically registering allowed ports without needing to actually do any NAT work but that would certainly seem useful.