I do more or less exactly this.

CloudFlare domain that has a bunch of listings which point to my reverse proxy, which is only available via Tailscale.

I then share that proxy node and a TSIDP node with the tailnets of my "users" (this avoids the user limit, they don't have to switch between tailnets, and I don't need to share a new machine wherever I add a new app)

They go to the public URL of a given app > CloudFlare sends them to the proxy > they authenticate via TSIDP > and are auto logged into the app.

So far, works pretty well.