Your options are only as limited as your imagination and complexity of your requirements.

If you're only using it on your network, just use HTTP with mdns (or have static routes from your router or something, but you said you don't want that) so you don't have to remember IP addresses. If you want TLS, you can borrow someone else's domain with a service like FreeDNS.afraid.org (5 free subdomains). Or if you control the devices completely, you can make a root CA and add that to each device's trusted CA list, and then sign your own certs and eliminate MITM attacks.

You have options, and most are overkill. The simplest, secure solution is HTTP on your local network or over a VPN you trust (if you have a publicly accessible IP, just host your own WireGuard server on/via your router).

How i do it:

• Wireguard for VPN endpoint on the pi and device that I have root on, secure, fast to setup and doesn't add a lot of overhead

• For access outside of VPN:

You might have to pay for a domain name if you dont have a static IP, which is relatively cheap.

You can manually allow trusted IP to access the service in your firewall which nullify surface of attack if done perfectly but is really an hassle to setup and maintain. I'm looking to setup Keycloack for a strong pre-auth that I can share between services and that is also lightweight (Authentik is not lightweight, Authelia seems to be i'd like to try it aswell) This coupled with firewall rules and/or fail2ban like service should be more than enough for a private server I think.

I'm not taking this to lemmyml

You can also add a second network interface to the computer that needs to access the jellyfin server over LAN.

So you want a self hosted jellyfin instance that you only plan to access at home, as secure and simply as possible?

Buy an HDMI splitter.