Tailscale (which we have been using to great effect over the last year or so) provides effectively a 'LAN' where the devices can be anywhere. It provides you with a second interface in the 100.x.x.x range. You can trust that any traffic from that range has been authenticated to connect to your Tailscale network.

Hoppy (as I understand it, I've never used it) is more solving the issue of getting a static IP assigned, with the advantage of it following your device if it moves between networks. You get a second interface that is publicly visible, but can't trust traffic coming in from it.