for a beginner with just a few remote clients, tailscale all the way.
though I still like doing it the old way with a custom nginx setup, fail2ban and a domain name, but its more work to make it secure and even then it's still somewhat of a liability.