1) On the server side this port is taken from a range set in config key.
#UDPPort 4011-4999
It can be set to just one value instead of the range but in that case only one session will be able to use UDP. If it’s a range, a port is selected randomly at session start.
2) You can set it in the player GUI to use a specific port instead of a random one from range. However it’s a global setting, so all sessions will use the same. In that case, only one session will be able to use UDP.
3) It will be sufficient to forward single UDP port set up on both sides, it’s a separate setting in client and in server and both have to be forwarded. Otherwise the whole range has to be forwarded.