Jellyfin is free and open source software for one. I don't know the exact difference in the feature set but I have heard people complaining that Plex is focusing more on surveiling it's users to push ads. I just got Jellyfin working with linuxserver.io docker image on my rpi4 and it is pretty nice.

Jellyfin is fully open-source and doesn't require any third party authentication. It's not quite feature complete versus Plex but it is very close, and has never been a issue for me or my users.

That's not the way to do it. If anyone can break out of Plex they are on your local network.

Besides, if you're going through all that networking hassle, you're better off doing things right. Get a real firewall like pfSense, then setup a separate network just for outside facing services. To access those services locally create firewall rules that allow traffic 1 way: from your trusted network to your outside facing network. While you're at it, consider making separate networks for IoT devices, and maybe even another for untrusted guest devices. You can use VLANs or physical interfaces if your firewall has enough ports.