Comment by BasedInfra

You can use Cloudflare access for internal which is tunnel + identity access management for end users.