If you are the only user and don’t need to use those apps in devices you don’t own a vpn is the way to go.

If not. Depending the number of users you could do some heavy ip geoblocking to at least reduce the exposed surface.

There are a few services I have just like 3 IPs allowed to get a response from caddy, any other ip gets 403 error.

Does it work with android and TV apps?

I tried long ago and failed.