The default -net user is essentially a "wrapper", tcp/udp traffic from within the emulator is essentially just wrapped around the user-land "socket/send/recv" functions.
The only way to "forward a port" is via a command line argument:
$ qemu ... -redir tcp:9000::22
In this example, The "host" port 9000 is open, any connections to localhost:9000 would get redirected to the guest OS, port 22. (SSH).
Hope that helps.
