What are the numerous incoming connections I see on public wifi for?
netbios

You could block the netbios connections with Little Snitch. These connections are connections attempt most usually coming from Windows sharing the same Wi-Fi network and testing which share and printers are available on your computer. This protocol behaves like a guy entering a new building and testing all door knobs, when the door opens he asks: What's your name? What do you share? Do you print?
This protocol is stupid, and dangerous, but most notably for Windows.
This protocol is the leading vector of malware broadcast inside LAN of companies using Windows since more than 20 years (toward the floppies era). This protocol is responsible of the largest security damages within big companies.

netbios is a security threat.

On all my Mac I tear off this service (netbiosd), during the post installation procedure (see: …to disable WINS in Network settings, working on 10.7, 10.8, 10.9).

mDNSResponder

You couldn't and shouldn't block the mDNSResponder because you would break the normal working of the DNS on your Mac. I.e. you won't be able to find the IP address of www.microsoft.com.

mDNSREsponder isn't a security threat (today).

Firewall setting

Your method to block connection through the MacOS X firewall is the correct and safe one within any aggresive environment.