Tips for setting up a small private Discourse behind a firewall?

Yes, it is possible. You need to decide:

  1. Whether you will use internal mail server or allow outgoing access to mailgun or similar (will expose data via email)
  2. If you have control of internal DNS and want to give a nice domain name on internal network IP.