To both of you, wireguard is the way to go.

So, parent poster: yes, you are doing it right.

Grandparent: Use a VPN, close everything else.