You might consider using something like Cloudflared or Tailscale’s Funnels to proxy the connections through to prevent DDOSing and apply ACLs. You can still use your domains with those.