How does Oracle Application Express connect to the database?
Application Express, together with either ORDS (Oracle REST Data Services) or a similar web service such as Glassfish, is basically a set of processes that run in the database, usually connecting via internal connections. Application Express basically serves HTML web pages to allow access the database and display reports, and so end users only need a web browser to use an Application Express application, with reports, ability to modify data, etc.  This is a huge simplification, but for your purposes, all you need to know is that end-users just need a fairly current web browser that supports HTML5 to get all the fancy web pages for accessing/modifying the data in the database.  APEX comes with a security framework, or you can also use your own corporate security.