I’d suggest port forwarding. Opening a port on your firewall just says “there’s a service running on this port” but the software will have it’s own “risk mitigation” to prevent intrusion.
Additionally, if you own a domain with someone such as GoDaddy, you can leverage their API to script IP updates (quick google search can walk you through options; cron, powershell, etc) so you can always access your nextcloud instance with a friendly name.