Worst case scenario, you could just run Tailscale directly on your Jellyfin server.
Why is that the worst case it’s goes literally like this: install on your server, install on the other decide (phone, laptop), connect to the same account and BOOM works
good luck getting a smart TV to run Tailscale
My mom uses this approach to access my media files. It’s a Sony Android TV and works pretty good actually
Tailscale is based on the wireguard protocol, which has already very strong encryption
Tell him to switch to jellyfin and that he should give you tailscale access
jellyfin + tailscale is all you need. It’s so damn good and easy
Would love to hear why the problem doesn’t need a physical solution, if you want total control