Lion Server: Send remote lock from outside LAN
Yes, you'll need to either forward these ports to your Lion server, or put the Lion server in your firewall's DMZ. You will also need to make sure that the DNS name of your Lion server is resolvable to devices outside of your network.

The Apple Push Notification service used by Profile Manager will tell your device "Check in with this server", but your server needs to be resolvable and accessible for your device to actually check in and get the command that you've set for it in Profile Manager. That's why the lock command is working while your laptop is on the same LAN as the server.