In the moralityScale class, yes.
Don't add the player as an argument to any of the functions, the moralityScale already knows which player it's attached to (the one stored in the field).
Again, you don't need these arguments because the moralityScale already knows its current morality value and which player it's attached to.
Data persistence and networking are completely separate. Only the server persists the game state (i.e. writes your capability to NBT and writes the NBT to the disk), the client doesn't need to persist anything.
This is correct, just have the packet set the morality value directly; it doesn't need to do anything NBT-related.
Side note: I recommend following Java naming conventions by using PascalCase for class, enum and interface names and camelCase for field, parameter, local variable and method names.