To understand the need for a ArcSDE service, we need to understand the architecture better. And to do that, we need to go back in time to the version 8.3 onwards.
When you run the installation for ArcSDE (or PostInstall pre v10.1), it creates a repository in the database, which are basically supporting tables for your main data. (From 10.1 onwards there is no PostInstall, as I understand)
When you add a new featureclass in your SDE geodatabase, it is not stored as just one table. The Information is spread across multiple tables. When your version data, and edit it, even more tables are affected.
For the data to be saved in the correct tables, the client, or whichever software is saving the data, needs to know about these specific tables, and do things correctly. Even when reading from the geodatabase, the information has to be read from various tables and collected together to make a feature class as we know it.
Now your ArcGIS desktop and ArcGIS Server are smart enough to do that. But what about those clients that are not aware of all these different tables?
That is where the ArcSDE service comes in. It acts as an intermediary between the clients and the RDBMS back-end. You want to query the data from the command line? Sure you can do so by connecting to the service.
In the past ArcGIS desktop had limited knowledge of the RDBMS back-end. Over time ESRI has made ArcGIS desktop more and more aware of the repository tables, and given it the ability to manage the data directly. That is why nowadays there is very little need for the SDE service. ESRI has been pushing its clients to direct connect from the time of 9.3 onwards. And in the latest version making a three-tier connection is a pain.
(Ok so I sort of cheated here. This isn't the only reason for having A service for SDE, but it is the Main reason)
So to summarize, Unless you face some major problem in your workflow, you are not missing anything by not using a service. Using a Direct Connect is the way to go.
Now coming to your question about how to access the map services outside your network. (Actually this should be a seprate question, but I'll give you a short answer).
The Server is supposed to be installed on a seprate machine, which has access to the internet. Either it can be in the DMZ or your firewalls needs to be configured such that it allows some connections to your ArcGIS server. Your WebApp will the access your ArcGIS server using its public IP or hopefully a domain name.