Bastille looks promising will check that out.Ports/packages are not part of the base system and should be kept that way.
sysutils/firstboot-pkgs might be useful for you. If you use sysutils/bastille you can create templates that will automatically install/configure things too.