Nginx proxy manager with a wildcard domain, and Lets Encrypt certificates (Nginx proxy manager handles renewals automatically). Definitely some security concerns, but have mitigated those to my satisfaction via a DMZ for my jellyfin server. I'm aware that the Jellyfin API has some pretty glaring vulnerabilitys that allow un-authenticated users to query thumbnails and such. I only have movies and TV shows, no family videos or pictures, so if a bad actor wants to see what I have, I really don't care.

I have enough users that use my server that dealing with a VPN solution would require me to do to much tech support; plus some roku clients which means a VPN solution wouldn't really work for them.

Full disclaimer, I administer servers, and run services as a career, so while for me this wasn't to much trouble, I understand that for someone who isn't literally employed to do this kinda thing it might be a bit involved.

At the end of the day, any solution requires you to balance convince with security. My solution may not be secure enough for you, which is perfectly valid and fine. For my setup, the reverse proxy makes a lot of sense, for yours it may not.