A VPN will always be better for this purpose, but as long as you properly secure your SSH server, shouldn't be a problem

Abstracting complexity and user permission management (with -arr stuff having none iirc)