It sounds like you currently have a default ssh connection between the laptop and server:

Kubuntu_laptop--->nat_fw--->Debian_Server

Modify the parameters to the ssh connection so you have

-fNL [localIP:]localPort:remoteIP:remotePort

For example:

-fNL 5900:localhost:1234

If your laptop used VNC on the default port of 5900 then you would tell your laptop to vnc to localhost which would then send the VNC traffic on port 5900 to the server on port 1234.

Next you need to catch the traffic arriving on port 1234 server side and forward that to the desktop:

Debian_Server<--nat_fw<--Kubuntu_desktop

Modify the parameters to the desktop ssh connection to include

-fNR [remoteIP:]remotePort:localIP:localPort 

For example:

-fNR 1234:localhost:5900 

All traffic sent to port 1234 on the localhost of the server will now be transported to the desktop and arrive on port 5900 where the VNC server is hopefully listening.

Change port 5900 to be appropriate for the protocol you are using. Could be 3389 for RDP or 5901 for VNC since 5900 might be in use. Also, I just picked port 1234 randomly for use on the server.

It sounds like you currently have a default ssh connection between the laptop and server:

Kubuntu_laptop--->nat_fw--->Debian_Server

Modify the parameters to the ssh connection so you have

-fNL [localIP:]localPort:remoteIP:remotePort

For example:

-fNL 5900:localhost:1234

If your laptop used VNC on the default port of 5900 then you would tell your laptop to vnc to localhost which would then send the VNC traffic on port 5900 to the server on port 1234.

Next you need to catch the traffic arriving on port 1234 server side and forward that to the desktop:

Debian_Server<--nat_fw<--Kubuntu_desktop

Modify the parameters to the desktop ssh connection to include

-fNR [remoteIP:]remotePort:localIP:localPort 

For example:

-fNR 1234:localhost:5900 

All traffic sent to port 1234 on the localhost of the server will now be transported to the desktop and arrive on port 5900 where the VNC server is hopefully listening.

Change port 5900 to be appropriate for the protocol you are using. Could be 3389 for RDP or 5901 for VNC since 5900 might be in use. Also, I just picked port 1234 randomly for use on the server.

*Some notes in response to your updated question:

1. the default port for ssh is 22, so the -p 22 is redundant since it overrides the default and sets it to 22
2. the settings that look like localPort:remoteIP:remotePort have nothing to do with the port that ssh is using for the tunnel which is still 22 unless you override it on the client with a -p and override the port on the ssh server as well. So all of the previously mentioned ssh commands are using port 22 and you can confirm this by looking at your listening and established network connections. You will not need to open any additional ports on a firewall. The previous commands were correct.
3. based on what you added in the update, the command for the desktop should be autossh -M 5234 -fNR 1234:localhost:5900 [email protected]
4. sorry, I have no suggestions as far as a VNC client is concerned. You'll have to open a separate question for that, however I'm guessing it will be down-voted since it is an opinion question.