MariaDB | Sync Master with Slave in another Datacenter
The Master (in A) does very little work to provide the replication stream to the Slave (in B); don't worry about it.

There will, however, be a slight delay between when the data is available on the Master and when it is usable on the Slave.  But, since you are talking only about Disaster Recovery, I don't need to lecture on "Critical Read".

I think that the replication is opened by the Slave, so the port being opened needs to be on A.  Normally this is the same 3306 used for other clients.  (But your tunneling may lead to something else.)