Jack - welcome to the world of real modem/routers
Mine has been on permanently for some years. It means any of my computers can connect to the internet when required. I just switch off the ones I'm not using. Likewise the kids when they're here, etc.
If it's a decent router, it will contain a NAT firewall, which is a lot more effective than any firewall in your PC. I would still run a firewall in the PC (ZoneAlarm for example) for "belt and braces" protection.
A malware operator trying to connect would come up against the NAT firewall, and be repelled. He may not even know that there's anything at the end of that bit of wire from the internet.
You can check that
here - well worth doing. Go to "Proceed", then "Common Ports" on the next screen. If it reports perfect stealth, stop there. If not, you already had the problem but maybe (just maybe) we can sort it.
I would suggest you don't want control - you want competent software looking after you! Shields Up! will tell you...