Firewall for sites that are remote sites on SD-WAN?

Let me start off by saying I am very new to SD-WAN..

I was wondering what type of architecture is recommended from a security perspective for sites moving to SD-WAN. If we have remote sites that will tunnel all their traffic back to the data center do we need to have a firewall in place at the remote sites? What if we decide we want to route some traffic straight out to the internet like O365, should we have a firewall on it in that situation?

Right now the current plan is for 2 SD-WAN routers at the site (for redundancy) and tunnel everything back to the data center but wasn't sure if this was going to be sufficient from a security perspective.

Thanks in advance!