The manpage for git pull, below \"Options related to fetching\" says
You never do your own development on branches that appear on the right hand side
Your workflow is correct.
Have a look inside your .git directory at the root of your project, examine the config file and you should see something like
[remote "origin"]
url = git@bitbucket.org:something/projectname.git
fetch = +refs/heads/*:refs/remotes/origin/*
these lines are consulted when you type git fetch origin.
You can see that actually the right-hand-side of the pull/fetch is actually something that contains remotes/origin. What they are saying is do not edit the remote tracking branch.
By typing
git checkout -b un-3437 origin/un-3437
you are creating a local branch that tracks the "locally stored remote tracking branch". When git status says you are ahead or behind by X commits, it is comparing un-3437 to remotes/origin/un-3437.