Comment by AdrienPoupa

I'd argue the easiest way to achieve this is to refrain from opening any ports, and using Tailscale to get remote access.