Selfhosted

Tailscale. You don't need to open up ports + you can set up exit nodes, which are useful if you're sailing the seven seas.

WireGuard is the fastest method, it’s free, there is no reason not to use it.

In that case, wireguard. I only occasionally need to access a service that's not exposed to the internet, so I use ssh -L, but that would be quite inconvenient for your own use case.

I know tailscale exists but I've never used it, only tried wireguard on its own. Maybe there's some huge benefit to using it but wireguard worked fine for me.

There's no magic bullet here. If you want good defense against bots you should use fail2ban and/or crowdsec. Geoblocking is also worth looking into. You will always have to open a port if you are selfhosting a VPN and will need to take aforementioned steps (or alternatives) to secure it. I believe Tailscale is a very good alternative for people who don't have time to do this as it does not (to the best of my knowledge) require you to expose a port.

I use Netbird (open source networking software from a German company) as it integrates well with Authentik and allows me to use the same SSO for VPN and most of my other services. Setting it up with Authentik and Nginx is a bit complicated but very well documented in my opinion. I do not have a positive experience of the official Android client but Jetbird is a nice alternative. Setting up DNS servers and network routes through peers is quite easy. Enrollment is also a breeze due to the Authentik integration.

My Asus router has a a few nice ones