The safest way to handle this is to not expose them to the public Internet at all, and instead to use Tailscale to allow other folks to access the apps in question–though the more people you want to have access, the trickier that gets. Here are some resources addressing that method:
