Apple Remote Desktop Over WAN

Set up a VPN into the target network, preferably into your firewall as that greatly simplifies NAT when mixed with a VPN, and with this your client system—running ARD—is now effectively a client on the target network. Various mid-range firewall boxes offer VPN servers, which makes this far easier than VPN passthrough, or setting up the per-client port-forwarding rules at the firewall as you're considering, and the VPN protects your network traffic, and it keeps the internet riffraff from bouncing (directly) off of each one of your exposed machines with the inevitable brute-force attacks.

The riffraff will usually find newly-exposed network ports within minutes, too. The background hum of the internet is folks running port scans and brute-forcing efforts.

For firewalls with embedded VPN servers, I've used ZyXEL ZYWALL USG firewalls and these are quite capable boxes, though they do assume some familiarity with networking terms and VPN concepts. There are other options.

if you want a more detailed discussion of the options and mechanisms, searching for VPN and ARD, and similar searches, should turn up quite a few discussions. Here are a few of the discussions I've participated, and each of these with links to more discussions. (I should probably roll all this into a user tip, but that's fodder for another day.)

Can I access my grandmother's laptop with… - Apple Community

Help with adding remote client in Apple R… - Apple Community

ARD question - Apple Community