

I’d suggest you to investigate either Tailscale or similar solutions. I’m using Tailscale, and it’s really easy to set up. It can automatically connect to the VPN when you access their resource, and the internet works as well. So technically, they can be connected all the time. That’s much safer than the alternative of just opening a port, and dealing with things like CGNAT.
The alternatives to Tailscale I know about are Headscale (which you need self-hosting), Netbird, WireGuard. At least, but there are more.
And search for tunnels as well. You could utilise Cloudflare Tunnel, but I wouldn’t go that way.
I’d suggest testing waters with Tailscale as it’s the easiest, and tweak from there. They have a YouTube channel which helps at starting, I found it just recently. (I use them for a year or two now.)
If you don’t setup or activate exit node, no traffic is routed through any of your nodes. All you have is the access to the nodes. Which is what you need. I tested exit nodes only recently, they’re very easy to setup as well, but I found no practical need for my use case.
I think installing and logging in should be trivial remotely. Like hey mum, install this app, and log in (trivial with Google or Apple accounts). The rest is on you. Just test the waters yourself first, you’ll get the idea, it’s pretty straightforward. Even if it’s not what you’re looking for, you’d have more information and skills to move to the next thing.