Tailscale or another Wireguard/VPN is the safest, but requires your users to have devices that support it.

Easiest is reverse proxy with domain and open ports, but your risk tolerance decides if that is viable or not I guess.

My users know that it’s Tailscale-able devices only or nothing, and that works fine.

I’d say spin it up and play with it. If it’s a lot of hassle, then stick with Plex for a little longer. It’s still a very good program, even if they are moving away from what they used to be.