Sorry, I can't help much. But let me say that I think your setup is fine. It is overkill, yes, but if you want to be able to further expand your hostings it's a good idea to start small. And ISPconfig is just fine for small and big.
Be warned that many of your questions are not related to ISPconfig, though. You might get more replies in special forums for NAT, networking, or such.
This being said, I am no expert, but I guess that ISPconfig and your hosts should do fine behind a firewall with NAT. FTP, IIRC, needs special proxies/support on your firewall. Personally, I guess, if you want your clients to use FTP I would not have it firewalled. Tried often, and it was always a pain in the ass. Another option might be to disable FTP and go for SSH/SFTP which works just fine behind firewalls. And if you care for security, I'd definitely disable FTP anyway.
HTH, -- xrat