Cloudflare Tunnel installed on your box (free)
Cloudflare Email Worker connected to your domain which writes emails to a KV store (generous free tiers)
Cloudflare Worker that downloads the emails from the KV store and uses Worker TCP sockets to send it to your mail server over the tunnel via a TCP port ie 25000 (CF blocks 25)
For sending mail in blue, local mail server uses smtp2go or Azure Communication Services.
I’ve pretty much convinced that a cheap Synology rack is the best way to do this because it replaces Azure ID (Synology SSO) and Exchange (Synology Mail) which self hosted non-SaaS in the one appliance, it gets security updates, and it has a easy web interface for setting everything up.
Haven’t managed to write the Cloudflare worker code yet, but found this guys repo and he’s done pretty much all the heavy lifting: https://github.com/Sh4yy/cloudflare-email