You could also use zrok.io. It’s an open source alternative which can be self-hosted or has a free SaaS. It also includes cool features like ‘private sharing’ (which means both sides can be private with no inbound ports). I work on the parent project.
You could use zrok.io, protected by the ‘front door’ feature being released today. Then you do not need users to have VPN tunnels, no need to port forward, easily accessible by anyone who is authenticated.