hey, I don't think you need to manipulate the nftables directly nor through firewall-cmd, if you use a container daemon, like the default mode in docker, it does that for you automatically. publishPort makes the container port available on the host directly even if the container is in an internal network. Someone can correct me if I missed something.
If I may guess why you're facing problems, I'd say because podman is daemonless, not sure how it is wired to publish ports without root.