>Is there a simple foolproof utility for blocking ports on BSD with a single command?

Yes. It is called pf.

    block in  on fxp0  proto tcp  to any  port { 25 80 }

... blocks incoming email and http connections on the fxp0 interface. That is all you need to put in pf.conf to do that.