Use a reverse proxy like Traefik to access your services via subdomain like paperless.yourdomain.com.
The advantage of that approach is you will be connected to Traefik on port either 443 or 80 (based on your Traefik setup). Most firewall will allow connection to port 443 or 80.
I’m running SearxNG as rootless docker container on my homelab for nearly 2 years now. I have connected it to Internet via VPN.