Not a web browser, the client has to install cloudflared to connect. It's pretty much exactly the Tailscale feature, but clunkier.
https://developers.cloudflare.com/cloudflare-one/connections...
https://developers.cloudflare.com/cloudflare-one/connections...
That said, personally I don't really have any devices that can use SSH but not a browser.
Read the docs, you can do it either way.
No headless boxes?
Also I wouldn't use Cloudflare Tunnels so this is a moot point.