Do I need to run a RADIUS server?

No. That is the part Passbeam replaces. There is nothing to install at the client's site, no server to patch, and no certificate authority to build and back up.

With RADSec the site's equipment opens an outbound TLS connection to us and keeps it open, so there is not even a port to forward. With standard RADIUS your equipment sends requests to our published address instead. Either way the only thing at the client's site is the equipment they already own.