my understanding of these terms is different than theirs
OK, lets try to clarify the relevant terms.
I would like to make some things clear … is it possible to have public IP and be behind NAT at the same moment?
Everybody with an internet connection has a "public IP" that is an IP-address which is visible to the general public.
This public IP-address is sometimes referred to as an external IP-address. It is usually allocated to your router by your ISP.
It can be dynamic or static. Some ISPs charge more for a static addrsss. Dynamic ones are allocated from a pools, in this case your public IP-address can change from time to time
Traditional IP addresses are IP version 4 addresses. These are running out. To stave-off address exhaustion, some ranges were reserved for private use (e.g. 192.168.0.0) and Network Address Translation (NAT) was invented so that a router could edit (translate) addresses in IP packets and change a private IP-address to a public one. That way a business or home with tens or thousands of computers could all share a single public IP-address.
So yes, most people have a public IP-address and are behind NAT.
is it simply because that my ssh client (PuTTY) can't receive incoming packets because of blocked incoming ports?
TCP connections are started by a client sending a packet to a server (as part of a "three-way handshake"). The router sees this packet, edits the from-address and keeps a note in an internal list of connections of the internal source IP-address, source port and translated source port (it has to cope with two PCs both using the same source port getting their source IP-address translated to the same public IP-address). Since it keeps track of connections, when the router receives reply packets it can work out which internal PC to forward the (edited) packets on to.
So no, replies to an outbound SSH connection should not be blocked.
connections initiated from the outside are a different matter:
When the router receives an inbound request to create a connection on a specific port (e.g. 80) - if it doesn't provide a service on that port itself (e.g. router admin interface) it won't know what to do and will refuse the connection.
If you want friends, random strangers (and criminals) to have access to your PC, you can tell the router that when it receives a connection request on port n to forward that request to one of your computers.