vaultwarden on a public IP - is it worth to restrict to VPN only?

I feel a bit embarrassed to ask this, because I am not able to figure it out myself.

I run a vaultwarden instance (open source bitwarden) on a public VPS on the open Internet. It is properly set up with an nginx reverse proxy with proper SSL termination and LetsEncrypt certificates. I also have yubikey required access enabled.

I should be fine.

Nevertheless, I am wondering why I should have a service accessible to the whole internet which is only for me (and possibly my wife).

I guess I could enable client-side certificate authentication, but I am not sure how easy that is to set up on the clients.

So I was wondering - would it make sense to have something like a VPN installed on the VPS, and have the service run behind the VPN - if that's even possible, as it is just a box and not a network?

Or could you think of some other solution? Basically the ideal would be that the service would be accessible only to a handful of people, but from anywhere (hence IP based isn't an option). Any suggestion is appreciated.

I personally host a vaultwarden server. I recently learned that this service is end to end encrypted. This means that even in case of database corruption, a hacker could not decrypt the stored passwords. The problem lies in the fact that the user connection can be compromised (Fake DNS, saving cookies etc) I have personally chosen with my partner to restrict access to our vaultwarden server to our VPN. This ensures that the DNS are chosen by the VPN and not by her personal computer. However, I am thinking more and more about removing the VPN restriction. This is very user heavy. I am permanently connected to the VPN and it does not affect me. But my girlfriend who often uses streaming services has to disable the VPN. This takes away her access to vaultwarden.