Without doing some hacky workarounds, I don’t think this will be possible. I also think the firewalld part of cockpit is limited. As far as I’ve seen, it only handles services/ports, and not complex rules such as forwards.
I also did some digging. If you want to use only firewalld, you could do something like this:
firewall-cmd --permanent --new-policy policy_int_to_ext
firewall-cmd --permanent --policy policy_int_to_ext --add-ingress-zone internal
firewall-cmd --permanent --policy policy_int_to_ext --add-egress-zone external
firewall-cmd --permanent --policy policy_int_to_ext --set-target ACCEPT
firewall-cmd --permanent --zone=external --add-masquerade
firewall-cmd --set-default-zone=internal
firewall-cmd --complete-reload
I believe this would get you started using firewalld and NAT.