I’m not sure about the portainer specifics but essentially yes. The VM running docker will need the storage and then each container will need a volume mounted to them from the host. In terms of where the media is inevitably stored, that volume can be mounted by multiple containers so they can all see it and do what they need to.
A vpn of some sort will always be more secure and safer. Exposing it to the internet is a convenience that you have to weigh the benefits of against the reduced security. If you don’t need the convenience then don’t worry about the extra complexity it brings.
The main benefit I see for a RP is the convenience of friends or family to just have a public facing url without having to install anything to make use of something I’m hosting.
Some people just like having a valid ssl cert or a host name to visit instead of an IP. These can be accomplished in other ways but a RP can make it easier.
In my use case I use a RP with authelia to require a password to some services, then maxmind geo filtering to limit where people can access from, and for some services the RP is set to only allow traffic from inside my network.