Restricting initializer and calling _disableInitializers in implementation contract deployed behind deployProxy

  1. Yes, but to prevent frontrunning, the initialize function should be called in the same transaction as the proxy deployment. This occurs by default when you use deployProxy from the Hardhat Upgrades plugin.
  2. _disableInitializers() is recommended. See What does `_disableInitializers();` function mean? for reasoning.