Maybe take a look into Cloudflare Tunnels, which sounds like will do what you want (maybe not VPN though).
The short version is you run a daemon on your local network that Cloudflare talks to. So, outside requests only see Cloudflare, and communication from your network only goes to Cloudflare. Your IP is not exposed to consumers. This is free! Though you are not supposed to send video/pictures though the tunnel and have them cache it without using one of their (paid) services, but it's simple to disable caching for a host. I do use their DNS, though I cannot recall if that's a requirement for Tunnels, though.
Keep in mind you should still set up some sort of firewall, as people can and do just scan the entire IPv4 address range looking for open ports.
It really is a nightmare, and even worse when you have to log into a service that doesn't have a "sign in on another device by entering this one time code" offering, and worse still when you use a password manager and your password is a long string of random characters. In this scenario, I've gone so far as to ADB into my device and use
adb shell input "whatever I would have had to type on the TV"
, which somehow feels faster.My last two devices, the fancy new Chromecast 4K, and then an Nvidia Shield, both use Google's regular keyboard when it can and is nicer in comparison. Still many streaming apps force you to use the built-in alphabetic keyboards instead of using the one provided by the OS.