Peplink 380 firewall capabilities

I’m looking at getting 3 x Peplink Balance 380 to link 3 of my sites together, but trying to understanding the firewall capabilities of these devices and if they can provide Layer 7 equivalent firewall functionality at each site or if I also need to have a firewall at each site to protect access to the internet.

The Peplink manual for the 380 appears to indicate basic layer 3 firewall functionality using ACLs and some DNS-URL/category based traffic filtering, but trying to understand how this compares to other firewalls with SD WAN capabilities.