Windows firewall + the hardware firewall in your router abd common sense when browsing is sufficient.
However no firewall is going to stop nasties if given permission to download - this is why nasties often come packaged with legitimate software you want to download.
so care must be taken when installing any downloaded software
always select custom install and untick all the options to install any add ons like browser helpers etc. that try and install at the same time.