How to set up standalone snowflake behind restrictive NAT?

No, Snowflake is able to operate with a restricted NAT, though it can only serve clients with an unrestricted NAT.

If you still want to make it unrestricted, see

Though another issue you might encounter is that the Debian version of Snowflake is outdated. You might want to use another installation method, e.g. Docker. See Doubts on Debian package: snowflake-proxy - #2 by WofWca.