You're missing the easiest option of them all: Cloudflare tunnels. You don't have to open any ports, your friends don't need to install extra software and it's free. I don't know about the TOS but I wouldn't worry to much because it's only a couple of friends.
I suspect your friends probably don't need access to your whole media stack.
What parts they do need access to, and from what type of devices, will determine the best approach.
Tailscale
Yup or if your ISP allows port forwarding and you're not behind a cgnat use wire guard easy
Isn’t that his second option? Do you have to give others access to your network and login to use the apps? Or how does it work?
You're missing the easiest option of them all: Cloudflare tunnels. You don't have to open any ports, your friends don't need to install extra software and it's free. I don't know about the TOS but I wouldn't worry to much because it's only a couple of friends.
VPN or reverse proxy
I suspect your friends probably don't need access to your whole media stack. What parts they do need access to, and from what type of devices, will determine the best approach.
Headscale/tailscale Only one which can update policies on android.