The only ports you need forwarded on your router are 80 and 443 to the local ip address NPM is hosted at, don’t forward ports to your services from the router. Your reverse proxy forwards traffic for each subdomain to the corresponding ip and port of your services.

The first is doable, but requires fiddling with DNS. I am not sure how exactly to do it with dyndns, but with cloudflare i can just add new subdomains from their interface, its very easy. If you can stomach paying for a domain, it might be the easy way to do it.

To do the second one, you want to create a new proxy host, point the root at something (cant leave it blank, setting up a webserver with a list of hyperlinks might be nice), and then click Custom Locations, and add custom locations for each service you want.