It is possible -- NAT won't protect you from inbound connections. Even using RFC1918 addresses on your LAN won't protect you from all inbound connections. You need a firewall for that.

If you don't trust the ISP device to firewall, then you can't trust it even for v4. You need to run your own router.