I’ll try enabling IPv6 on the pihole, I know at least if I get Ads with it on its not IPv6.
It’s both the IPv4 and IPv6 DHCP… You IPS router has to run DHCP (or similar) for both IP versions.
Both of them will provide your machines with ISP DNS servers / gateway and the machines will bypass your pi-hole. Since most operating systems will prefer to use IPv6 over IPv4 if you enable IPv6 you’ll most likely get ANY ad from any company that runs on IPv6 (most likely everyone).
When it comes to IPv6 it’s game over to the pi-hole if your ISP router doesn’t allow you to set custom IPv6 DNS servers (and set it to your pi-hole IPv6 address).
Anyways, as long as you don’t go into the router ISP and tell it to “forward port X to port Y on pi-hole” you don’t even need a firewall running on pi-hole, as nothing from the public internet will be able to reach it.
If you’re using a VPN on the Pi then you may run a firewall but restrict only to the VPN interface and set it do drop all incoming traffic on that interface unless related to some outgoing connection.