PuTTY local vs remote port forwarding: which default limits accidental public exposure?

I need to pick one forwarding approach in PuTTY for a team that tunnels to internal services through a shared jump host, and the deciding constraint is avoiding accidental public access to those services.

PuTTY documents both options under Connection > SSH > Tunnels: local forwarding binds a port on the client machine, while remote forwarding asks the server to listen on a port and relay traffic back. My understanding is that a local forward bound to the loopback interface stays invisible to other networks, whereas a remote forward can become reachable from any address the server's sshd listens on, depending on GatewayPorts and AllowTcpForwarding in sshd_config. PuTTY's own panel does not appear to enforce any of those server-side restrictions.

Assume a recent PuTTY release (0.78 or later) on Windows clients and OpenSSH servers.

1. For this constraint, is local forwarding strictly the safer default, or are there documented cases where remote forwarding is equally contained?
2. When the server sets AllowTcpForwarding no, does current PuTTY reliably surface a failure for a requested remote forward, or can it fail silently?
3. Is there any client-side PuTTY setting that guarantees a forwarded port binds only to loopback, or must that be verified on the server?