I forgot you could use SSH port redirection. By having them connect to your ssh server. Just understand that you need to configure it in a safe way to avoid someone using the credentials incorrectly.

See the section called “Exposing service running in localhost of a server behind NAT to the internet”

goteleport.com/blog/ssh-tunneling-explained/