That's a lot of questions so let's try to take them one by one.
If I now send a packet from X to Y, the router will receive it and
forward it. (?)
Yes, that is what a router does, it forwards packets from one layer-2 (L2) network to another.
The reason to use a router is becaue of NAT to the internet.
No. The primary reason to use a router is to forward packets. Additionally it can, but certainly doesn't always, perform additional operations on the packets such as address or port translation (NAT/PAT) or encryption (VPN).
You could just as well have public ip addresses on your vlan X so in that case, no NAT is required for it to connect to the Internet.
Or, as @RonTrunk mentions, if you do use private IP addresses then the NAT can also be done elsewhere, e.g. on a firewall between the router and the Internet.
Nearly everything is connected to the internet. That means I always
need to filter traffic on the router that connects the switches. (?)
It depends how secure you want to be (and how paranoid you are, or to look at it from another angle, how severe the impact would be of a security breach), and how well your hosts are secured.
Is there any setup connected to the internet, which doesn't need to be
filtered by ACL or VRT?
Sure, most home routers will typically do NAT but have no explicit ACLs.
Is it possible to use NAT without routig internally? Did I miss something?
Assuming that you mean that vlan X and Y both need access to the Internet (with NAT) but X is not allowed to communicate with Y (and vice versa) then you cannot "disable" the routing between X and Y so the simplest solution would be to use an ACL to filter that traffic.