Firewall is a bonus feature of SME, not the primary function. I would put a dedicated firewall-only box in front of SBS (IPCop, M0n0wall or similar).
Another popular (with my clients) scenario when they need MS Windows application server, is to use SME as a firewall, PDC, e-mail, web etc.. and install MS Windows based server as a domain member with applications running on it.