For a firewall I would probably just run it directly on the device rather than putting it in a VM on top of Proxmox. If you want to run other things in VMs then run Proxmox on a NUC (or one of the HP/Lenovo etc mini PC devices that are fairly cheap secondhand) behind the firewall. 

 Agree - on the router, just run your OPNsense directly. You want it to be a dedicated device.