If you really need to expose something to the internet set yourself up an SSO/OIDC provider and have it sit in front of the service and have a deny-first policy in place, whitelist the known few IP’s that need to connect regularly or alternatively geoblock.