I would avoid at all costs exposing the database to the public internet, even with IP whitelisting.

Make the apps/users connect to a VPN (wireguard or openvpn, setup on a seperate EC2/droplet). Then on the database server only allow connections from the internal IP of the VPN server.

Ideally the database is in a private subnet in the VPC (can't accessed directly from the outside at all) and the VPN server is a public subnet with an Elastic (static) IP. That is how to set it up on AWS anyway, I am not sure the DO networking equivalents off the top of my head.