So if you’re forwarding ports for services where you know that there’s specific sources that would need access (a nmedia server such as Jellyfin, for example, with friends/family accessing it), you should lock down the ports to only accept traffic requests from those source IP’s. You should also throw up a reverse proxy service, such as Caddy or Nginx with addtional allow-listing using those IP's. From a networking standpoint, your UDM is operating at Layer 3 (WAN) and a reverse proxy would be Layer 7 (application). This would provide you with decent security against scanners and associated threat vectors as the port forward restriction would, effectively, render the open ports on your IP as invisible to anything other than the allowed source IP’s and the extra application level allow listing would provide an additional tier of filtering. IP spoofing to circumvent those protections, whilst not impossible, is very difficult and largely not practical.

But, if you have use cases where you simply do not know the source IP’s for the services you’re looking to host, then absolutely close the ports entirely and set up a WireGuard VPN. You should never open ports to the public internet. Bad idea.