Essentially you setup your router to port forward any new incoming connections to Caddy, which then decides what to do with them according to the configuration (Caddyfile).
Even simpler: Your local network is like a castle, inside is a safe and secure place where your devices communicate freely. Your router is a firewall around the castle, by default it blocks incoming connections. This is good because the internet is scary. By port forwarding you allow a door in the firewall which leads to Caddy, which is like a guard. Caddy asks them what they want, and if they say e.g. jellyfin.example.com, then it sets up an encrypted connection with https to your local jellyfin server. If they want anything else they aren’t allowed in.