In my homelab I use an overlay Network VPN ( tailscale as Client together with headscale on a vserver, netbird would be another option). I prefer this to Reverse proxys ( Like Pangolin which aims to be an opensource clone of cloudfare tunnels), because this allows me to use any protocol ( including Cifs for Network shares) and don‘t have to deal with port forwarding. Depending on your Applications and Level of Paranoia a Proxy might be a better fit though.

In theory both a VPN or reverse Proxy could be hosted on ProxmoxVE but I recommend to use a dedicated server outside of your regulär Network if it shouldn‘t be connected with your Internet Services anyhow. Adding Clan as additional Security Layer Sounds Like a Good idea to me but I Lack real world experience with it.