1. No—traffic over an ExpressRoute circuit is not encrypted by default. However, you can create a solution that encrypts the traffic that goes over the ExpressRoute circuit.
2. Yes—a point-to-site VPN connection is designed to create a secure connection between an individual client and your virtual network over the internet. This connection type is most suitable for employees who work from other locations.
3. Yes—it is not allowed to host the server behind a NAT.