Firewalls help quite a bit - NAT is a firewall afterall - SPI adds to that
Client firewalls help out even more - and there - Windows/MacOS have options
This will get most thru safely, actually...
Then we have the client side - and there are network options that can help - too many to explain, but generally items like what AsusWRT includes via Trend Micro can help - and we have Snort/Suricata solutions for folks like me that run pfSense...
Local Antivirus - Windows Defender, while it being free, is actually quite good - MacOS has similar low-level stuff
But the best/real defense is the people between the keyboard and the chair - as this is the target vector - be careful on clicking links and attachments in email - try not to run Flash and/or Java (if you must, keep them up to date) - and keep the OS level stuff also current.
From the router side - best advice here - a) keep the firmware current, and b) don't expose services...