VPN is the safest way for most, but if you do want to expose it to the internet just blacklist all IP’s and whitelist the known few, maybe slap Fail2Ban on it but honestly doesn’t make much of a difference.

Traefik’s DDNS Allowlist plugin works great for such a task.