Start up from macOS Recovery. When the utilities window appears, click Utilities in the menu bar, then choose Startup Security Utility or Firmware Password Utility. Click Turn On Firmware Password. Enter a firmware password in the fields provided, then click Set Password. Remember this password. Quit the utility, then choose Apple menu  > Restart.

Your Mac asks for the firmware password only when attempting to start up from a storage device other than the one selected in Startup Disk preferences, or when starting up from macOS Recovery. Enter the firmware password when you see the lock and password field: