I'm deploying a new network for IOT devices, this new network will be behind a firewall. I've been suggested to also get the network natted to further improve security. Does this really add any security benefits? With a firewall I already have to explicitly allow any communication, adding NAT would make the managment (SSH, ansible) of this devices harder since I would also have to forward the ports or use agents instead of just allowing the communication in the firewall.
I agree with @RonMaupin in the comment: NAT is not a security feature but a workaround for the lack of IPv4 addresses.
NAT only add complexity without increasing security, if the network and the hosts are properly secured by appropriate measures (including, but not limited to, firewalls). Security does not reside in a single point.
NAT was never designed to be "security". It was a mechanism to increase the IPv4 address pool. (many behind one) In that era, no one was very concerned about security.
The security NAT appears to provide is an illusion. Just because your laptop isn't directly addressable from the public internet doesn't mean much, and there are a great many ways to punch a hole. But that's also about as far as most people's "firewalls" go: default deny inbound, allow outbound, no inspection of traffic in either direction. Without any intelligence on the traffic moving around, you don't have any security. You have no idea if anyone has made it into your network, or how they got there.
Your IOT network likely doesn't need the complication of NAT. When devices outside the firewall want to talk to some of those trinkets, you'll be glad there's no NAT.
Flip it around - when you deploy IPv6 on this network there will be no NAT, so why add complexity now that won't be available later.
Worse, if you dual-stack the network then v4 would have NAT and v6 won't. That could lead to confusion and outages all by itself.
The only reason for not futureproofing is that some IOT things don't do v6 yet. Don't paint yourself into a corner with a design.
NAT adds complexity but not security.