Recommended Security Profiles for default nat

That really depends on what you want to block, monitor and protect against.

At least the default AntiVirus and App Control is a good idea.  I would also suggest making a Web Filter profile that (at least) monitors what you want to monitor.

Applying the above (with logging applied to the policy) will give you some visibility into what type of traffic is passing through your network and where it is going.

The DNS Filter, while not strictly necessary can be used to enforce SafeSearch on Bing, Google and YouTube if you need that.