Your diagram looks sensible.
1st step is to check what versions of spanning tree the devices can use to interoperate and configure them accordingly.
Make sure you use a version that does "rapid".
2nd step is to configure your firewall/switch with a lower STP priority.
3rd step is to configure the "edge"(ie, not link ports) Procurve switchports as admin-edge-port
4th step is to configure the "edge" ports with either:
- bpdu-protection (disables ports that receive a BPDU), or
- bpdu-filtering (ignores BPDUs), or
- root-guard (allows and uses BPDUs, but will not allow the STP root to move to these ports)
5th step is configure loop-protect on all "edge" ports.