How to ensure, that firewall does not pass any external packets into LAN?

Am I correct thinking, that in the case of NAT and correct firewall config, one should see no any packages with "source address" equals to global IP inside the LAN?

Or NAT server will keep source address while translating?

I am observing multiple packages inside LAN from "source address" pointing to global IPs. Does this mean firewall is setup incorrectly?