Public facing services routed through a firewall or waf (cloudflare) always.

Backend access trivial with Tailscale, etc.

Public IP never needs to be used. You can just leave it an internal IP if you really want.