Not sure if it fits your requirements exactly but I just put a service behind TwinGate and it works well for my usage case. I can allow my wife secure access to services she needs to access from anywhere securely - she just opens the app to connect and she can access what she needs.
I haven’t but you can enable 2FA, as well as restricting based on things like hardware, OS and whether a device has biometrics.
I absolutely hate SO. It’s my last resort when looking for help, and I’ve never signed up.
Between snarky arseholes, the “already answered here” comments even when the question isn’t the same, and people saying “dw i solved it” and never stating how they solved it the whole place can just fuck of.