"1. a single static IP address. This wouldn't work with a mailserer and separate webserver."

It would because the mailserver and webserver will be using different IP ports - even without a reverse proxy, this setup can just use a single public IP.

The ideal (and most secure) way to run multiple services behind a single Public IP is with a reverse proxy - you have pfsense, so you have the hardware and capability to configure this. You can even run multiple websites on the same ports by using URL redirection.

Running (and paying for) multiple public IP's and using one per service is a very inefficient use of Public IP's ...

You don’t even need URL redirection to run multiple websites on a single IP address. Most web servers allow virtual sites which respond to the particular server name used to access the server. Analogous to the way that Unix can use different names for the same executable, via links, allowing the program to respond differently depending up the name used to call it.