The main idea is that the onion service only makes outbound connections. Whenever it communicates with someone, the onion service creates a circuit to some relay and receives communication from the end of that circuit. This way the relay accepts new connections (through introduction and rendezvous points) and forwards information to the onion service through the circuit it created. Therefore any data the service receives is through any outgoing connections/circuits it created.
If you wanted an analogy to a non-Tor network, it would be like running a lightweight web server on a VPS, and running your actual web server at home behind a firewall. Your home server would make a persistent outgoing connection (reverse tunnel) to your VPS. When your VPS received a new connection from a client, it would forward any data through your tunnel to your home server.