To access things outside of your LAN (for example from your phone while at the grocery store), each service gets a DuckDNS entry. “service.myduckdns.com” or whatever.

Your phone will look for service.myduckdns.com on port 443, because you’ll have https:// certificates and that all happens on port 443.

When that request eventually gets to your router and is trying to penetrate your firewall, you’ll need 443 open and forwarded to your Debian machine.

So yes, you have it right.

Also forward port 80.