- Yes. Given your computer spec/storage-space, you will probably want to run it as a pruned node though.
- Yes. Instructions.
- Regardless of Tor usage or not, you decide if others can connect to your node. Tor is not a firewall.
- Yes. You can start the daemon with flags
--no-igd --hide-my-port --in-peers 0
(these can also be applied in the GUI via daemon startup flags in the settings). - "best" is subjective and not really a suitable question for StackExchange. You can use either a Trezor or Ledger.