The way to think about these different concepts is like this. You have 3 parts to this scenario; first the private network at your home with your cameras and home computers on it, second the outside world and the entirety of the Internet, and third the firewall or router that is the device between the first and second parts.
The job of the a Firewall is in its most basic form, such as most home networks, is to be a one way valve. A normal unmodified basic firewall allows your home computers to speak to the Internet but does NOT allow the Internet to speak to your home computers. Think of the allowed flow of information back and forth by which device starts the conversation. If your home PC starts the conversation such as opening a web browser and going to google.com that is allowed. If teslamotors.com tried to call to your computer to tell you about the model 3 without your home computer asking first the connection is denied.
Remotely viewing your cameras is essentially "the Internet (your phone somewhere on the cellular network) initiating a conversation with your home network" so the firewall does what it does best and denies that connection.
How you can access your cameras remotely:
TCP/IP is the language of the Internet that all devices speak to each other, TCP/IP has ports ranging from 1 to 65535. Think of these ports like entrances to a building, like a large shopping mall will have multiple entrances that serve different parking lots or even different levels of the same parking lot. The first 1024 ports in the range are called the "Well Known Ports" as they have defined uses, port 80 is for web browsing (http), port 443 is for secure web browsing (Https), port 25 is for sending email between servers (smtp), etc etc etc. Ports above 1024 are know as "high ports" and do not have predefined rolls in the standard TCP/IP communications and can be officially used for anything you like. Each of these ports can be closed or open, if these ports were doors to a building then each door could be locked or unlocked respectively.
The simplest way to access your cameras remotely is port forwarding but it is also the least secure and the most vulnerable. Port forwarding is like saying this particular door to the building (for example port 80 http web browsing) doesn't go into the mall in general but specifically to Macy's. So if you were to walk into this door at the mall you would find yourself inside Macy's which is inside the Mall. But this also means anyone else who walks in that door would also find themselves in Macy's. Your camera system has a password on it but various cameras and DVR/NVR units are known to have vulnerabilities. Passwords are like barricades erected at Macy's where the passageway from the door gets to Macy's. A week password would make that barricade out of tissue paper such that someone could just walk thru it with little to no effort, a strong password would make that barricade out of 6" plate steel. The vulnerabilities of a camera or NVR/DVR might replace half of that plate steel barricade with tissue paper or even open space. But even without the vulnerabilities that strong password could eventually be broken, just as given enough time someone could cut their way thru 6" plate steel.
A VPN:
A VPN or Virtual Private Network is a secure encrypted tunnel that exists between two points on the Internet. A VPN in this scenario is between your phone/tablet/laptop out on the open Internet somewhere and your home private network via your firewall. A VPN is like having your own private entrance to the mall that has a barricade on the outside. If you walk into this entrance you are inside the mall in general and can go to any store you like in the mall freely. A basic VPN will have a password, in some form be it pre-shared secret and/or password, which again you can represent as different materials presenting more challenge to get past as password complexity increases, tissue to steel and beyond. Because some VPN setups can use multiple means to secure the traffic you can make it much more secure that simple port forwarding. You can essentially make the barricade much thicker that 6" plate steel. A very secure VPN technology is x509 certificates, these are digitally signed certificates that must be installed on each device that is to access the VPN. This certificate is used by the firewall to recognize individual devices on the open Internet that the firewall should talk to in order to form the VPN tunnel. With the right setup configured correctly you can make your building like Cheyenne Mountain, home of NORAD, complete with armed guards and about as difficult a place to get into as can be.
DDNS:
In order to use any entrance at the mall, be it the open door (port forwarding) or the super secure private entrance only you know about (VPN with x509), you still need to know where the mall is located. Static IP vs dynamic IP can be thought of like street addresses for buildings but with a twist. All street addresses in the real world are essentially "static" addresses. Your house or your work are always the same street address that doesn't change. Dynamic addressing could be envisioned as buildings suddenly having different street addresses. When you went to bed your place was at 123 Anystreet USA, when you woke up the next morning it was 433 Otherstreet USA. While you are at home this change means virtually nothing to you but if you are out in the world and want to find your house how do you know what address it is, it could be the same as when you left this morning or it might have changed. DDNS is a simple piece of software that basically sends you a text, either every set amount of time or with some other qualifier. That text basically says "your house is at the following address: 614 yetanotherstreet USA". This way you can always find your house. The catch is depending on what the DDNS system uses to choose to notify you there are times between the address changing and you getting that text telling you it has. Overall it is a pretty reliable and good system. The only real security risk it presents is if you have to run some kind of software on your machine to inform the DDNS system of what your IP address is at any given time. Many NVR/DVR units have builtin DDNS functionality, so you need only sign up for a free account, enter the account info in the DVR/NVR, and the unit will send updates to the DDNS system at whatever interval it is designed to do.
