The firewall will translate those addresses into a different, globally reachable IP address if the internal machine wants to make an outbound connection. Usually, home firewalls will use their own IP address, since there is only one IP address available for use. Business firewalls, on the other hand, should normally use a virtual address. This way, the address of the actual firewall is not shown to third parties out on the net. A NAT firewall may have filters to only allow outbound packets on certain ports, or it may simply choose to allow all outbound connections.
Clients just have to know their default gateway, and that's about it.
There is no way to allow for special protocols that require a return connection to be made. If you wish to restrict certain types of protocols, you can only limit access to certain ports. On the one hand, this is too restrictive, because internal folks may not be able to accesss webservers on non-standard ports. And at the same time, this is too permissive, because there may be a disallowed service running on a non-standard port on the outside, and your internal folks will be able to access it in this case. An internal machine only has to know where to send packets to reach the outside, similar to a NAT firewall.