With regards to firewall configuration, please refer to OSIsoft KB00944 - Which firewall ports should be opened for PI AF Server? and related KB articles.
Will every app create its one point-point connection to the server?
Does every trend display create new connections?
No, except there is a reference to a server with no active connection.
Will every user, that makes uses of e.g. ProcessBook, start its one connections
or is there a broker like functionality on the client that is collecting and combining requests to the server?
Each copy of ProcessBook in memory creates its own connection.
A question that you did not ask is if any data access product requires a running service on the Client. This is the case with PI SDK which connects to the local PI Network Manager that communicates with PI Network Manager on the PI Data Archive node. The same is valid for dependent data access products like e.g. PI OLEB (Classic) Provider and (legacy) AF SDK. The RDA (Rich Data Access) AF SDK assembly uses direct RPC's.
Thank you very much for that explanation.