All right I secured AdGuard Home a bit better now. Only port 443 is open, port 80 is not on the edge firewall. The web interface is still exposed to the web but it's HTTPS encrypted with my own certs