I thought you said you didn't want the PCs to see each other
but only see the NAS. Anyway, if you're happy with how things are working now, that's fine. You don't want to turn off the firewall but want it turned on with the local network allowed as an exception. Now, while a common workgroup name does allow all the PCs in that group to see each other, this doesn't mean that PCs with other workgroup names cannot find each other. But accessing files across the network is more a matter of setting permissions. Which version (Home or Pro) determines how you do that. You don't want to use "simple file sharing". Another idea you might consider, however, is mapping shares from the NAS to your other PCs as desired. They will show up as another drive on the PC that needs access.