Hello,
Based on this article it is not mandatory to have a RADIUS proxy however they mention that it will be mandatory if you are using EAP-TLS with certificate :
"NPS supports authentication across forests without a RADIUS proxy when the two forests contain only domains that consist of domain controllers running Windows Server 2008, Windows Server 2003, Standard Edition; Windows Server 2003, Enterprise Edition; and Windows Server 2003, Datacenter Edition. The forest functional level must be Windows Server 2008 or Windows Server 2003, and there must be a two-way trust relationship between forests. If you use EAP-TLS or PEAP-TLS with certificates as your authentication method, you must use a RADIUS proxy for authentication across forests that consist of Windows Server 2008 and Windows Server 2003 domains"
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197447(v=ws.10)?redirectedfrom=MSDN
This thread mention someone you make it work by adding the allow to authenticate right on the NPS :
https://social.technet.microsoft.com/Forums/windowsserver/en-US/039ec884-3ad6-45c7-90cb-f2bbe84a6113/nps-authentication-crossforest-domains?forum=winserverNAP
Normally you should have more information in the NPS log
Regards,