A firewall won’t help you much beyond making sure no unwanted ports are open. The ansible install of Lemmy makes sure to only expose the ports 80 and 443 to the outside, which is fine for running a webserver. Additionally, Lemmy sets up a containerised environment for itself, so even if Lemmy is compromised, there is an additional hurdle to overcome if somebody wanted to compromise the underlying server itself.

As a more general security tip, I’d recommend you set up SSH with key based authentication and disable password authentication after you did that. Passwords can be brute forced, completely compromising your server if found.