is there a way to configure a router as a spoke router where it does not have a PUBLIC IP?
It like this:
Spoke Router -> private IP -> NAT router -> Internet -> DMVPN Hub router
I tried it on 12.3(14)T7.
There is no problem to have DMVPN spoke behind NAT.
Usually on a stateful device you do not need to allow any ports for incoming traffic.
However UDP/500 and UDP/4500 will be needed if you use tunnel protection for DMVPN or GRE if you don't protect it with IPsec.
I'd suggest trying on a device with newer software. 12.4(15)Tx or 12.4(24)Tx ?