As noted in the TALOS blog Leo linked - yes NGFW/NGIPS will prevent the compromise (assuming it is setup correctly).
The same Snort Rule Update (released back in April) that covered Microsoft's MS17-010 blocks the CnC traffic.
The incoming infection can be blocked by AMP if you have it licensed and a file protection policy in place.
