How can the attackers reach different ports on my LAN, not configured in NAT? UPnP …?
That is possible only if your server was compromised or external connections come over opened by UPnP ports. When you create forwarding rules, you may specify what port or range of ports will be forwarded to particular IP resided on the LAN side. You can also change (substitute) external port(s) to local ones with different values (external port 3456 forward to local port 22, for example) or set one-to-one forwarding (external 22 to internal 22). So the short answer – only the ports you opened on the firewall will be forwarded to particular IP on LAN.
If you set your server in DMZ zone that it means your server is fully exposed to the Internet with all ports; this way all ports are available for external connections.
Check also this list of vulnerable routers; if router itself was hacked, then it isn't your network anymore.
Is it possible to block / stop these blind attacks?
Take a look to the similar question and followed answer how to secure and reduce such scanning attempts.