I never open any ports to the open Internet other than the two my friend client uses.
For remote access I use a P2P VPN called ZeroTier leaving it always running on the Pi, and switching it on for the remote device when needed. It's free for up to like 50 users and is very powerful, but dead simple.