Sponge plugins can be placed in either the mods folder or a designated plugin folder defined in the Sponge config (defaults to mods/plugins). The section of the docs for this is here.
Please note that some plugins which make use of Mixins are required to go in the mods folder because they’re processed long before Sponge loads any plugins. If you only have a handful of mods (or don’t mind searching a little), I suggest keeping everything in the mods folder purely for this reason.
As far as versions go, the version of Forge included in the Sponge version is just the target build - these are generally the latest recommended version of Forge at the time of the build’s release. Most of the time higher versions of Forge will work just fine, but sometimes they make breaking changes. Unfortunately, some mod developers build off the latest version instead of recommended, and that can lead to compatibility issues down the road. Feel free to test later versions, but understand that Sponge won’t officially support that until the next recommend Forge build is available.