Yeah, sharing is one of the big problems with Immich. You either need to expose your whole instance to make share links publicly accessible (and there's no way to secure user accounts with 2FA), or create user accounts for the people you want to share with and/or invite them and set up your VPN for them to access the shares.

There's https://github.com/alangrainger/immich-public-proxy, which is a weird workaround (it's a separate gallery frontend that syncs with your instance to only expose this specific service, so you can keep your Immich instane private).