Comment by yorwba

You don't need a NAT for that, it's a job for a firewall. You could have each poorly secured device with their own IP, but still not reachable from the outside.