Remote acces : PiVPN, Tailscale or open port and a regular VPN ?

[Aenard]

Hello,

My current situation :
Running a Jellyfin server in a Debian 12 Virtual Machine on my ISP Internet box (Freebox Ultra, for my french fellows), to which I connect an external 4To drive through USB 3.0 for medias.
Local works wonderfully, have access through web browser on my computer and on my Amazon Firestick.

Now I'm trying to set-it up for remote access but I'm not sure which path to follow and to be fair I'm a bit confused.

1. First I've heard about reverse proxys it seems a bit obscure to me and from some comments not the best way any more.
   
2. Then I've found out about PiVPN.
   
3. Finally, the latest threads I found on reddit talked about the "easiest" way : Tailscale.
   

A few questions now :

1. Aren't PiVPN and Tailscale basically doing the same thing, and if not what's the difference ? 
   
2. Does those two use an "already opened / safe / secure" port on my router or do I have to open one myself any way ? 
   
3. In any case, do I have to use Dynamic DNS and if "yes" could you explain why ?
   
4. If I do have to open a port myself for them, how is it any better than getting a static IP, opening a port, forwarding it to the VM and connecting to it through my regular VPN to hide traffic ? (Proton Premium through Wireguard, in this case).
   
5. If I do en-up having to open a port, never communicate my static IP to anyone and always connect to it through Proton, what are chances someone finding it and what can they do, in my case, locked in a VM ? Can they go further ?
   
6. How do I control and limit write access of my jellyfinserver ?
   
7. Kind of a side question, but anybody with experience can comment the process difficulty and performances loss in encrypting the media drive with Veracrypt and how does it work with Jellyfin ?
   

Thanks in advance for taking the time to read and any enlightening you can provide !