Let me rephrase the question to see if I understand:
What are considered best practices re: auto-reply and auto-forward for employees for e-mails that are received from the internet.
I don't know about the best practices, however, I believe auto-reply should be disabled for internet e-mail; auto-forward can be enabled (the e-mail is FROM the internet, so... it should not contain sensitive information unless it is encrypted.
However, I would make sure auto-forward is turned OFF for internal e-mails, as you now are sending unsecured (potentially sensitive information) messages over the internet.
Possible exceptions on the auto-reply would be for sales representatives with major clients. However, IMHO, those should be forwarded to an alternate sales representative, NOT to a person who is out of the office.