It can be done, just carefully. You can definitely accidentally block yourself out if you set a firewall rule up incorrectly, or in higher precedence of order for example. OPNsense (like almost every firewall known) processes rules in a “top down” order. So you put your blocks at the bottom!!!

Reverse proxy won’t lock you out, essentially that’s just slapping HTTPS on a webserver/service like Jellyfin, so you can access it without requiring a VPN.

Here’s a reverse proxy explainer, pt 2 is the actual setup!