Where are you getting these instructions from? It's likely there is documentation that explains how they intend for you to do what you want.
Needless to say, you can pass -y like so:
curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
-s instructs sh to read from stdin even though there are command line arguments (-- -y). The -- is necessary so sh knows to treat -y as an argument to the script, and not a flag for sh itself.
To your actual question, curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs downloads some data from https://sh.rustup.rs and outputs it. If you visit that URL, you'll see the contents are a shell script. So that's what you're downloading.
sh is a basic shell program that can parse and run this script, such as Dash or the Bourne shell.
The | character pipes the output from the command on the left to the input of the command on the right. So curl ... | sh means "Download this text and run it". Although this is a somewhat common pattern for complex installers, it's technically a form of remote code execution, and can be risky. Be sure you trust the source before routing arbitrary content from the internet into sh, bash, python, or other shells or programs that process commands on your local machine.
As you may have noticed, you could also just download the source code from https://sh.rustup.rs and run it directly:
cd ~/Downloads # or wherever you save it to
sh rustup-init.sh -y