Head scale is a good middle option - it uses Tailscale’s DNS system but you are able to control your network as you would with Wireguard