Lowest seems to be Protectli (https://eu.protectli.com/vault-2-port/) or any of the chinese 4-port devices (Topton, Qotom, KingNovy, ...) in a barebones config where you add your own RAM & SSD.
ARM-based devices are not supported by pfSense / opnSense so you should stay with x86_64 based devices.
ARM-based devices are not supported by pfSense / opnSense so you should stay with x86_64 based devices.