IPv6 Dual-stack and Outbound rules

[phoenix]

I'm still (slowly :))working my way through implementing IPv6 on my LAN. I've got to the stage that I have everything set-up, whether it's correct or not is a moot point but my initial question is this: do I need to make any change to  outbound NAT rule generation?

I still have IP4 so this is a NAT scenario with fixed IPs for IPv6 on the OPNsense WAN & LAN (plus wi-fi) NICs, everything else is automatically assigned (for now). The thing that concerns me is that a port scan shows several other port that are open on my mail server other than the required 25, 587 and 443 for web mail access - perhaps I'm missing something obvious but how does one close or restrict access to these open ports on IPv6?