So, for PPSSPP multiplayer, you either need to be in a LAN with the other players or, as you’ve said, forward the port.
So, if you’re on the same LAN as your friend(s), it’s as easy as setting the IP address to the host (on all the clients) and the same wifi channel in PPSSPP settings.
If you wish to play online, it gets tricky. Most cellular data providers are behind something known as a CGNAT, which basically prohibits port forwarding.
The only solution and workaround to this is to use a VPN tunnel that can put you in a virtual LAN with your friends but over the internet. One of the most commonly used software on PC for this is LogMeIn Hamachi. Not sure if there is anything like it on Android, though.
I’ve actually set up a Yu-Gi-Oh Tag Force tournament for DLE but that quickly went nowhere after a couple episodes lol
PPSSPP will attempt to establish connection to any IP or domain that is put in the ad-hoc server text box. So, much like a web browser, it entirely depends on where you tell it to connect.
That being said, as for any security concerns, I am unaware of any exploits and/or wrongdoings with PPSSPP code, so you should be safe. It only passes the data directly between the emulated games and the chat box feature.