The first point is a perimeter firewall & its rules won't help your external users under DDoS as most likely your link will be saturated and/or the firewall overloaded with malformed packets. But what it can do is prevent your internal users from loosing the service, which I believe was the issue in reply to JDX. Of course, it also reduces the probability of a service under overload from becoming vulnerable.
The second point, the external users IP address, then it all depends. For example my home is on cable in the UK and my IP address has changed only 7 times in the last 4 years. And had I use a /16 mask then only 2 changes would have been needed (obviously trading off more potential zombies attacking).
We have an arrangement we we can log-in to our web server and ask for that IP address to be added to the firewall permissions, in a few minutes it then opens up SSH access, etc. Not totally automated, but good enough to allow modest home (or on-site) working to function while keeping out almost all login-forcing attempts.
As for IPv6, we just ignore it for now as our current infrastructure (and most UK broadband connections) don't support it by default. But eventually we will have to use it, so yes I will accept more potential pain there.