Plex centralizes authentication at plex.tv
When a user wants to connect to a 'private' plex server, they must first sign into their plex.tv account, which then provides the auth token needed to login to the users server (even if both the client and server are on the same lan)
With this system, Plex can monitor and control every single connection to every plex server; limiting access to whatever they want. Even your own local content.
Sounds like you're behind cgNAT, which essentially means there's another router owned by your ISP that's between yours and the open internet, which also requires port forwarding, but your ISP will never do that for you.
It complicates things, but the solution(s) are tools like tailscale, cloudflare Tunnels, or to rent a VPS just to host a proxy/vpn.
Plex solves this by using their own public servers as a proxy for you, but this is part of how they have control over your users/server/data, such as blocking remote streaming... That makes more than a few people uncomfortable.