See if there are any apps that will handle the VPN tunneling transparently, then provide the web interface, all in one.

If you can’t find any that work like you want, I would put an authenticating reverse proxy in front of jellyfin. But last time I tried that, it only half worked. I don’t know if that’s changed.

Worst case, a reverse proxy that only exposes the necessary endpoints. Or a WAF that can block known attacks.

In any case, you should have a firewall rule as narrow as possible to only limit access to them. Static IP address if possible, then subnet, then ASN. Whatever is the most restrictive but still works.