Use a reverse proxy like Traefik to access your seevices via subdomain like paperless.uourdomain.com.

The advantage of that approach is you will be connected to Traefik on port either 443 or 80 (based on your Traefik setup). Most firewall will allow connection to port 443 or 80.