A reverse proxy is just for convenice of stuff like hostnames and ssl termination. It’s not a security layer.

The proper way to do it would be to have your public stuff in a DMZ , if untrusted users (i.e. could have malware on their device) are going to access it.

Personally I use Netbird and host a tiny server in the cloud, which a local node connects to, to avoid NAT or firewall rules. Since it’s self-hosted, there is no user limit.