I don't know anything about homekit, but the best way (albeit with some learning curve) is to use a reverse proxy. Installing Nginx Proxy Manager in docker is maybe the easiest way.

Then you forward porta 80 and 443 (http and https) to the IP of NPM.

Buy a domain or use something like duckdns. This will make a URL like "homeassistant.duckdns.org" (for example) that points to your home IP address. You can manually update your home IP(most aren't static) or have software update it automatically. You can also skip this step and just type your IP into the address bar of your browser (or the Home Assistant app). You'll have to keep it updated manually this way.

So you visit that URL, it goes through your router to Nginx Proxy Manager, and you tell NPM to forward that stuff to the internal IP of Home Assistant. NPM can create certificates to make it all secure, and the login is handled by Home Assistant as normal.

There is additional config in config.yaml to allow your reverse proxy. This adds an additional layer of security.