1. if you configure the device so that access from outside is possible then yes, but of course every person who wants to access it also needs a password. So it is important to use strong passwords and if possible after e.g. 3 failed login attempts to lock the IP until it is manually unlocked. This helps to avoid bruteforce attacks, but still you should not share really important data with the internet, because you never know what new exploits are going to hit the internet.

2. for PCs within your network it's really the same game, nothing works without a password unless it is explicitly configured that way. Access is controlled either directly via the PC application or via regular SMB, i.e. "\\hostname\freigabe".
Of course, you can determine the respective names yourself.

Unfortunately I don't own this device myself but they should all work about the same. Perhaps someone who owns this exact device can write something about it and correct or supplement me if necessary.

I hope I was able to help you.