Ideas for securely exposing Jellyfin to the Internet

Hi everyone. On my home lab (Proxmox) I am running Caddy reverse proxy with ACME certificates for internal services. Right now the only open port on the OPNsense firewall is for WireGuard.

I would like to also expose my Jellyfin instance to a friend (for a hassle-free use on LG OLED TV), but keep it as secure as possible without getting a separate VPS. Jellyfin now is on a trusted VLAN (but not on a management VLAN).

My current ideas are as follows:

1. Expose uncommon TCP port to the internet, and whitelist my friends IP address
2. Setup Caddy so that it also does IP address filtering of friend's IP
3. Friend would simply enter my custom domain+port to connect

Some questions:

Would it add to security to run a separate Caddy instance on a isolated VM just for this purpose? (as opposed to exposing my main Caddy instance which is server my whole internal network)
Currently my Jellyfin is running on unprivileged LXC as systemd service, would this be good enough, or shall I get a separate hardened Jellyfin instance in an off-chance that it would get hacked.

Any other ideas to harden this further?

https://redd.it/1x6d6l8
@r_SelfHosted