I’m a little late to the party, but a fairly easy way to combat that fear is to install Tailscale (free) on your server and have them do the same on the AppleTV. It’s supported from version 17 I believe. It uses Wireguard to encrypt so your ISP won’t see squat.
I’m hosting a server for friends and family too and I refuse to open ports for it. It works super well and is fairly easy to setup.
Sounds like you are setting up exactly what I have running!
GMKtec G3 (N100 Intel CPU) running in Proxmox with NFS access to my NAS.
It works like a dream, transcoding everything I throw at it with ease.
Just a quick piece of advice: Repaste that sucker the moment you get it. I threw some Noctua paste I had laying around and it worked wonders. The only time the fan kicked on was when I added the libraries and Jellyfin had to sort out 6 TB of media from the NAS. Took maybe 10 minutes before it was done and ready to go.
Let me know if you need some help setting it up. Proxmox and Tailscale (if you want that) had me stuck for a few hours trying to understand TUN.