Cradlepoint CBA850 for OOBM

Hello,

Curious if anyone would care to share a typical setup/design of how best to achieve OOBM to a small stack of network devices which would sit behind a cradlepoint CBA850 we are thinking of purchasing? More specifically, since I am assuming we would have/need a static public ip address, we are curious if to gain access to device(s) situated behind the cradlepoint - is it possible and secure enough to simply use the cradlepoint only and lock down access to only specific inbound IP's? OR, is it recommended to throw a firewall in as well for more features + security? We would ideally be connecting to a console server with all networking gear connected to that. thanks