OPNSense requires AES-NI, which is an intel feature so you're stuck with an Intel CPU. Atoms are one of the more efficient intel options if you want passive cooling. as a sibling comment mentions, another option is an odroid-h2.

either way, i'd rather over-provision for an extra $150 than discover i need all new hardware when my requirements change.