You don't need any open incoming ports to run a Tor hidden service, or even really worry about NAT. You certainly don't need a dynamic DNS provider.
Your Tor peer simply must be able to connect to some of the Tor relays and you will need some time for your
.onion address to propogate through the distributed hash table.
Exact process is here.
The Tor peer builds circuits to the so-called "rendezvous" point - so it has initiated the connection (meaning as long as you have outgoing access you are fine) and maintains it - and it receives data through these circuits with the rendezvous points.
Now, where ports come into play is in configuring the hidden service.
Typically, you want program you want to make available via Tor listening on localhost or 127.0.0.1
You specify in the Tor hidden service configuration in this way in the configuration file - for example:
HiddenServicePort 80 127.0.0.1:8080`
Port 80 is what the
onion address users must use.
127.0.0.1:8080 is what your program that you want to make available via Tor must be listening on. Tor does the rest.
You do not have to have port 80 open on your router for this to work, and you don't have to care about NAT.