The docs don’t mention NAT. MAAS doesn’t setup NAT and I think we don’t describe a scenario where the MAAS controller is the network gateway. There’s no problem in doing this, it just requires extra configuration in the host.
You can check at “IP Masquerading” in https://ubuntu.com/server/docs/security-firewall
About the snap vs deb debate, it makes no difference for MAAS. We support both packaging formats and they have exactly the same functionality.