zerotier and tailscale is very good at this. you can lock down everything and it wouldn't matter because you still can connect from anywhere with all the security you want at each places.

i run multiple zerotier networks at different levels and they all work transparently.

i dont like tailscale as the hosted platform wants you to use an oath login and i have had bitter experiences with it so zerotier it is.

zerotier does not have a public gateway option where you can have a network only access the internet via a certain point (maybe it can be done but it isnt easy as tailscale) but i am happy with it.

i also do not have to worry about VPNs and all that because zerotier does that for me.

you can self host both so you are in control at all times