Firewalls are essentially have fixed 'structure', and would not be 'updating' to begin with, whether or not Microsoft discontinues the operating system.
XP will not be having any more operating system fixes.
Those are modifications to alter behavior within the system itself, that has been revealed to allow malicious behavior when instructed to do so from some outside source.
Firewalls do NOT stop malware. They only block unrequested packets attempting to enter the system.
For instance, your browser requests something from a website: the firewall makes a note of that request and then when those packets (bundles of data) return and seek to get in, the firewall examines the headers to verify they match a previous request. If they match, they are allowed in. That goes for requests by anything already behind the firewall (inside the system).
Packets attempting to get in that don't have a noted 'request', are 'dropped' outside the system.
If you happen to request something that is malicious (unknown to you), that asset will be dutifully returned thru the firewall because it is verified as a legit request.
Some 3rd party XP anti-virus/anti-malware software may continue to update themselves, but those are not operating system 'fixes': those are updates to scan for 'strings' of code that are known to be malicious. When it finds a match in some returning asset, it blocks the operation(s) that are in the payload.
I use Linux and don't have to fiddle with all this junk, so I make no specific recommendations, other than to say Windows users must be security experts if they intend to use that OS on the Internet.