What's the best way to have a device completely exposed externally?

I have a security device that acts as a decoy, that will then block traffic based on what is done to the decoy. (It uses port scan's, and any connections to it as metadata to determine if the connection is a bad actor) It also monitors the traffic coming from the internet as well. So the good filtering the Palo does could actually degrade it's ability to determine a bad actor.

I'm wondering do I create a separate zone just that interface, and nat it over, and allow all traffic no filters?

Can/Should I do something with virtual wires (which I've never used)

Any other suggestions? I only have 1 connection to the ISP, and if I put a switch in before the Palo it causes other issues.