I've got a reverse proxy for stuff I want to be able to hit from the outside. It's behind an SSO portal with 2fa (hardware token). Then for everything else I VPN in.

I haven't seen anybody else suggest it but "99% invisible" is one of my favorites.