What I can add is that if you selfhost locally your arr stack with jellyfin, there is no need for reverse proxy, authelia…or whatsoever !
If you are going to host you stack and make it available over the net and open ports in your router, yeah it’s mandatory ! With a wireguard tunnel… (I think portainer is the way to go for most user).
Locally you can just connect to your jellyfin’s private ip without to much complicated overheat.
Just secure and isolate your torrent connection and use a good VPN (like proton VPN).