> Granted I assume you can probably create a default DENY rule for inbound traffic and selectively open ports up as exceptions. Right?

Sure, of course. That’s how firewalls work for IPv4 as well— you have an implicit deny rule at the end, and then allow rules come before it.