Hello @Milo, as the node has internet access, I would say just installing NetBird there would be enough, and would probably work fine without opening inbound ports. On our cloud service, you would need to ensure that these ports are open for outbound: FAQ - NetBird Docs
With this, you will have Proxmox accessible via NetBird, and you can control who can access it via our dashboard.
Let me know if that helps.