Q: Does anyone know how to WAN Block and enable Port Scan detection?

... Someone keeps 'hacking' my router.

Can you explain what that means, specifically?

There are no user-selectable options to prevent scanning of open ports, but that itself won't result in any intrusion.

Did you assign your Time Capsule its own password? I believe the default configuration is to propose the same password for both it and your wireless network, which is less than ideal. Make sure you are using WPA2 personal and a reasonably secure password, and specify a different password for the Time Capsule itself. Change them every so often. A large number of people don't change their default router passwords, or use one of about a dozen common passwords.

Bear in mind physical access to your Time Capsule, or your Mac for that matter, makes anything possible. Your network is as secure as its passwords and will be as inaccessible as the Time Capsule. That is all anyone can do.