My Cloud authentication

When setting up a user to access the NAS from the internet so that they can save files, does WD just handle the authentication through their end and the data goes directly to the NAS or does the data pass through their system as well.

If it’s in Port Forwarding mode, it’s direct to the NAS.  

If you must use Relay Mode, it goes through WD’s systems via an OpenVPN connection.

are there any known security issues, specific to this device, that one should be aware of if they were to use Port Forwarding on their router?

Also, if one utilizes port forwarding does that cut WD systems completly out of the picture?

What ports need to be forwarded?