Wireguard is good if you don’t want easy access to notifications or location based automations. Otherwise you need to always make sure the VPN is on.

Lots of good info here I’m not going to repeat, but I think if you’re going to open home assistant to the public Internet, you should not use duckdns. It’s better to get your own domain and set up a reverse proxy to use https. Or if it’s too technical, subscribe to nabu casa and let them handle it for you.