Can you elaborate why you think you need much more PCIe network cards? Technically you can do with 1 single LAN port with all your VLANs.
You configure the VLANs on the router then make a single trunk port to a switch. then have that switch divide the VLANs on the ports you desire. this can be a L2 switch.
What is holding you back in regards to VLANs?
Configure the firewall with a IP whitelist to only allow connections to ssh be made from your home IP.
Other then that, disable password logon for ssh and setup up key based authentication.
I don't really agree with you here. If you take the time to set things up properly. And prepare for IF something would happen. Your fine. Been running a exposed jellyfin server for years now. Never hat a security issue. And even if I would, not much harm could be done anyway due to how it is setup.
How difficult can it be to just give someone a login? I don't get the whole sharing jellyfin is difficult argument. It is just as easy as any online service 🤷♂️
Kubernetes comes to mind for that
Or a openwrt to make it L3