Jellyfin Remote Access with Whitelisted Dynamic IPs

I've been scouring the internet for a way to implement this, but I haven't been able to find it. Most of the recommendations simply say to use tailscale/VPS/etc, but I'm not interested in anything that prevents Jellyfin from being accessed remotely from a smart TV / streaming stick. Networking has never been a particular strength of mine, so I've been doing a lot of learning lately, but I have an idea of what I'm trying to accomplish that doesn't seem like it should be as difficult as I'm finding it to be (famous last words, I know). Since Jellyfin doesn't natively support MFA, and the plugins that could enable it won't be able to run natively everywhere, my "brilliant" plan is to have to following setup: Head to my domain remotely from a smartphone/laptop, log in with MFA Whitelist the IP the request came from for a set time period Allow normal login to Jellyfin on the smart TV I'm sure there are a ton of flaws in my plan that I can't see, or maybe it just isn't possible to implement. But it feels like that's a pretty good way to protect my server, no? I don't want to use Cloudflare Tunnels and violate their ToS, and I don't want anyone to be able to access Jellyfin without first authenticating with the server. I'm open to any ideas that could accomplish this! (Running TrueNas Community / everything in dockge)