Yes, the remote PBS needs to access port 8007. It would be a good idea to only allow traffic to port 8007 from the IP address where you have the remote PBS.
You cannot limit what API functions are available via port 8007, but you can limit what the API token can do.
I usually create a user...