1. I believe FileBrowser supports this, however it is a paid application. You may be able to find a free alternative with a little bit of Googling.
2. In this configuration, the Time Capsule must not be behind any other router. You would simply check the box "Share Disks Over WAN" in AirPort Utility and configure how you want to secure the disks. I prefer accounts especially when connecting via the Internet. You can connect then by using your public (global) IP address.