If your forgejo host needs to connect to the outside world, you can open the port for incomming traffic only for related and established traffic. That way when somebody wants to connect to your port as a new connection it will fail. So when somebody has bad intentions, it will not work unless you've already connected to them in the first place. You need to permit outgoing traffic from forgejo if you block outgoing traffic.