Hi
to tag remotely from a client you must be using the Authentication option, which needs a password and access key. Although it might appear your are changing the metadata, you are not. The Library a client loads is, lets call it a "virtual" copy, that is "synced" with the actual JR library files on the machine running mediaserver.
Once the access key is entered you will not be asked for credentials again. If you are accessing via direct IP it is essentially read-only (note: not sure if playback stats gets ported over or not?? this shouldn't be an issue, but if someone could confirm - I no longer have a WAN setup just using JRemote presently externally)
So don't give out your access key to anyone, (note: if you restore your library file to a friend's machine to help set them up, your access key does get ported over. If in doubt, have them turn off the option Auto Sync with server under Media Network/Client Options). They do need the IP and port etc. of course.
There are a few things you can not do from a client, two of which you want to do. Here are the key ones:
Importing
Rename, Move, Copy of files and folders
Cover Art Manipulation
Creating/Modifying Views
To do those you need a remote desktop app running on both machines. I recommend the freeware version of TeamViewer. Easy to setup, powerful and doesn't take up a lot of resources
EDIT: on syncing, you would normally havbe the auto sync option on. The sync is a very low priority process, and if you have spent a bit of tie tagging an album, you might want to force a sync by File=>Library=>Sync changes ... to avoid that the server does not overwrite what you are working on. Doesn't happen all of the time, so normally this is not an issue.