In this regard, the component use a couple of defaults when choosing which baseUrl to use when generating reset links:
if the user click the Forgot password link on the main (vaadin) login window, it will use the URL obtained by concatenating the values from GlobalConfig#getWebAppUrl() and the ext.security.resetPasswordLinkWebPath property
if the request comes from the sendResetPasswordLink REST service method, it will use the URL in the ext.security.resetPasswordLinkPortalUrl property