I think the easiest way would be to have two vlans on your local network. One that is connected to the internet and another that is local only. I think you’d have to switch networks when wanting to access the jellyfin server in that instance, but would negate the main issue, which is your VPN.
Edit: that’s about the most secure you can get I think. If you bought a different physical router to host it, you’d have about as secure a setup as possible.
I think the easiest way would be to have two vlans on your local network. One that is connected to the internet and another that is local only. I think you’d have to switch networks when wanting to access the jellyfin server in that instance, but would negate the main issue, which is your VPN.
Edit: that’s about the most secure you can get I think. If you bought a different physical router to host it, you’d have about as secure a setup as possible.