As long as you are seeing the ports closed that is all that matters. Your Nat device should not be allowing any ports through at all in a basic config. So if someone scans the routable ip that is assigned to your NAT device, and all ports are showing up closed, dont worry