Your firewall/router by default will block incoming traffic and only allow traffic outbound that is initiated by the internal LAN side. Make sure the firewall is turned on, yes. Especially if this is the final route out to the internet.
So incoming connections initiated by the outside should be dropped by default but you can do a full port scan of your WAN public IP address(es) here: http://www.hackerwatch.org/probe/
That should help you gauge if anything is open or not open.
There are other steps such as ensuring your WAN IP for management purposes on your router isn't accessible (to prevent external access to it by hacking attempts), along with secure passwords instead of the defaults on it. Make sure it's on the latest firmware and ask TP Link if there's any known exploits against that router.
This isn't fullproof by any means, and you'll need to be thorough about your security if you ever change anything or do allow inbound port access for things like VPN, hosted apps (like websites/email), etc.
If you are super concerned or it is a big deal to management, consider hiring a small firm to do a penetration test and security assessment from time to time.
Finally, relax....you are probably a small shop, so don't go crazy trying to create all kinds of layers and customization. Put in place what makes you and management comfortable without being so draconian that people cannot work.