Secure remote access to Wago PFC200 PLC visualisation via the internet

Hello
I am in the process of building a home automation system based on a Wago PFC200 PLC. This controller has the ability to store visualisation in the form of a webserver (i.e. webvis). The previously created visualisation is accessed over the local network via a browser by entering the IP address of the controller and the path to the visualisation (e.g. 192.168.0.100/webvisu/webvisu.htm).
I would like to expose this visualisation in a secure way to the outside world (access via the internet) so that it is possible to access it from a mobile phone (iPhone). The PLC is connected to a Teltonik router, on which various extension packages can be installed, e.g. OpenVPN etc....
I know of two options:
1) Buying a fixed IP and port forwarding - not very secure but probably the easiest way from the point of view of control from a phone
2) Access via zero tier - this already works for me, but the iPhone blocks the client from running in the background and before you can open the visualisation you have to open the zero tier app - I'm looking for something nicer

Is there any possibility of buying e.g. hosting, which would constantly expose this visualisation to the world? Or is it possible to make option 1 secure with some kind of certificate and only allow devices that have a certificate?
Please at least give me a password hint in which technologies to look for.

Is webvisu.htm just the statically generated state at the moment or does it also contain some scripts, connects additionally to services etc.?
Can you show the source code or take a peek if additional connections are used (F12 in the browser and open Network / Network tab) to assess if the scripts connect to anything else to update the values?

The WebVisuV3.bin process is executed cyclically (every 200ms), in addition to which the images displayed in the visualisation are loaded when a window is opened.

Is access to this file password protected or available to anyone on the local network?

It is accessible to everyone. I would prefer to leave it that way so that no password has to be entered, so that use is immediate and more convenient.