Getting a remote user into your LAN is basically accomplished by setting up a VPN server and having your friend use a VPN client to connect.
Tailscale and Hamachi are two popular VPN services. Tailscale has a free plan that allows something like 2 or 3 users, so you could use that.
You can also set up a VPN by hand using WireGuard or OpenVPN. WireGuard is very popular these days. Tailscale actually uses WireGuard under the covers. It just takes care of configuring it for you. Tailscale also provides extra features to deal with NAT.
I’ve never tried installing Tailscale on a mobile phone acting as a hotspot. It may work. Tailscale has extensive documentation on their website.
Alternatively, your router may have a VPN server that you can use.
Lastly, you can install a VPN server onto a computer. You’ll have to configure port forwarding on the router to allow remote address to the VPN server.
This is just the basics. You can find plenty of guides for any of these options.
The AC Lites don't have to be ceiling mounted. I have two Unifi AP sitting on shelves.