Pretty URLs without forwarding port 443

[donnnnnb]

I have searched and searched, but I'm not finding a solution or posts that are very helpful. 

I want my users to be able to enter one URL like jellyfin.mydomain.tld into either their web browser or TV/phone app without specifying the port number. The apps can do this, but not web browsers.

Cloudflare tunnels are not an option, it is against their TOS to serve video if you're not serving it from their Stream or R3 service. It is also against my ISP's TOS to expose well-known ports. My users aren't savvy enough to use a VPN, and it would be very difficult to get a VPN to work with something like a Roku.

My thought is to setup a separate host just for the Jellyfin Web client on a VPS or something, and point the default server to my home IP on port 8920. But I'm unsure if the Roku/Phone apps will pick up the actual server if I give them the web client address.

Second thought is to setup a rewrite rule in NGINX that serves web content from jellyfin.mydomain.tld, but rewrites the video stream URL's to home.mydomain.tld:8920. Not confident I can do this without breaking something, or if it would even work in practice.

Is there another option I am not considering?