Regarding your second question, here is the packet flow for the SRX :-
http://kb.juniper.net/InfoCenter/index?page=content&id=kb16110&actp=search
Depending on the type of NAT, Junos gives the flexibility to restrict access in security policies as well.
Hence, even if you configure a static nat for a single internal IP to an External IP, you can still restrict the ports using the security policy.
Regards,
Sahil Sharma
---------------------------------------------------
Please mark my solution as accepted if it helped, Kudos are appreciated as well.