All of my public facing sites are behind a reverse proxy. I use Nginx Proxy Manager it runs from docker and has an easy webgui. It takes care of things like https certificates and stuff to.

Use wg-easy has a dead simple web ui then just send your friends a link to wireguard downloads page and a copy of the their .conf file it has an import button.

I just tell them its the app you need to connect to my network. True enough and I’ve never had anyone have much issues.