[adrianN]

You don't want any devices accessible over the normal internet. Set up a Tor Hidden Service, require some authentication at the bastion host to your internal network and you're good to go.

https://youtu.be/j2yT-0rmgDA