As far as hole punching/long polling, how is NAT different than a firewall with deny inbound and only allow outbound connections?

Technically, with NAT you don't even have a route to the internal stuff. While with the pure firewall approach there is a route.

In practice, yeah, not much of a difference.

Each person is supposed to get assigned a /64 from their ISP, which will be then assigned to any downstream devices.

Then you get your bill from your isp, $5 extra per device.

I can seriously see this happening.

I don't.

In the past you paid for the extra's because the ISP had to do extra work for it.

But if the ISP sets everything up so all users have enough from the start. Like a /48. You won't have to bother them.

Actually, most deployment recommendations expect, that ISP will allocate something larger than /64 to each customer, with /48 being the ideal scenario and something like /56 being reasonable.