Adding 'OSX Server Account' from outside
This is a partial answer, but it perhaps contains valuable information to whoever is reading this.

As I was able to add an 'Internet account' from inside the LAN, I decided to set Wireshark to work and try to figure out the port that way. I found out that the initial authentication and selection of services is done via port 443.

After forwarding port 443, I was able to add the internet account from outside the network. This pretty much answers the question, but does not resolve the issue for the full 100% yet, so I figured I'd still keep this open for a bit.

At this point I'm stuck at creating an agenda in the iCal account, however, running into a rather generic error message:



This is a work in progress, and any pointers on that error are appreciated.

EDIT: Further network sniffing let to no more information. Once logged in, the rest of the traffic is conducted over port 8443, which is duly forwarded. However, it still won't work outside the network. The fact that it does not work via VPN as well strikes me as odd, and makes me suspect a different issue than the TCP layer.