If you're going to the trouble of having a tunnel solution then you don't need public SSH or whatever else to begin with :)

It's a pity IPSEC is still such a total dumpster fire on Windows as it works great for ad-hoc with everything else, but thankfully Wireguard has been about as light-touch as VPNs get and I've had good luck getting it out of nearly any network.