If everything has static public IP addresses, then you could configure manual port forwarding: https://documentation.meraki.com/MX/Site-to-site_VPN/Automatic_NAT_Traversal_for_Auto_VPN_Tunneling_between_Cisco_Meraki_Peers    BUT, you are missing out on the benefit of automatic AutoVPN.  Could you maybe point out that the MX is a firewall, and doesn't require another firewall to protect it?  Otherwise how many layered firewalls do you need do you need to add to protect the existing firewalls?  The discussion becomes circular quickly. ... View more

You would implement this using firewall rules. There's different places you can apply them, but the most logical for what you're trying to achieve would be "Site-to-site outbound firewall" rules. These are configured under "Security & SD-WAN -> Site-To-Site VPN".   Take a look at the below link for some extra info and examples Site-to-site VPN Firewall Rule Behavior - Cisco Meraki ... View more