It's pretty easy actually but when authorizing GMail to add a new sender address it usually mails a verification code to that address. Which, in this case would come back into the same Gmail inbox.

So if you have a [email protected] forwarding to [email protected], then the verification code would be sent by gmail to [email protected], which in turn, due to your forward settings, would redirect all mail to [email protected].

The difference is that when sending mail from your Gmail.com inbox as opposed to the Google apps inbox for [email protected] is that when you send a mail via gmail (even if you fake the sender), the signed-by field will contain "gmail.com". On the other hand, Google apps for domains will set the signed-by field value to "Y.Z" (which would be your domain name).

As far as I know, this is the only difference. In Gmail, you can even set the default sender-address as your custom domain address so you don't need to set it everytime you reply to/compose new emails. And, unless you think/feel that signed-by: domain.name is cool, you're not really missing anything.