Using something to whitelist the firewall doesn’t require any client changes. For the less technically competent it could be as simple as setting their TV’s web browser to default to the white list page.

Haproxy could be convinced to whitelist people based on DNS entries. Each one of your remote consumers could set DNS to their house and once a day HA proxy would rewrite itself to match those addresses. If they’re coming in from a fixed client, The DNS would white list and let them in, If they failed the IP check they would pop a login so you could still use the service via the web.

It’s a hassle,It’s nowhere near as elegant is what plex is doing but without a data center…

They really could stand to add TOTP to the clients and server. I wonder if they’re open to pull requests. It can’t be that hard to add the option to the server than the clients can pick it up whenever they get around to it.