You could use zrok.io, protected by the ‘front door’ feature being released today. Then you do not need users to have VPN tunnels, no need to port forward, easily accessible by anyone who is authenticated.

Twingate does a better implementation of zero trust principles incl. least-privilege, microsegmentation, etc.

A colleague wrote this - https://blog.openziti.io/set-up-a-secure-multiplayer-minecraft-server