Tailscale has this same functionality, and is free for something like 100 hosts. Uses wireguard as the backend tech. It also has apple tv and android clients, so you can setup the Tailscale app on an end client for a user, then setup the jellyfin client and they should be good to go. That vleint device will just "see" your jellyfin server as a local client on the same network, albeit a tailscale wirrguard overlay network.

I haven't actually deployed it as I don't share my media server currently, but I was investigating it a bit ago.