Both. Some things are only resolvable internally or over wireguard. Some things are publicly accessible via a reverse proxy.
Overseerr, bitwarden, plex all have ports open or through the reverse proxy. Same with email and a few other services. All the *arrs are accessible only on my network or over VPN.