So, is public accessibility actually required?
Does it need to be exposed to the public internet?
Why not use wireguard (or another VPN)? Even easier is tailscale.
If you are hand selecting users (IE, doesn't actually need to be publicly accessible), then VPN is the most secure and just run a reverse proxy for ease & certs.
Or set up client certificate authentication, so only users that install a certificate issued by you can connect to the service (dunno how that works for 3rd party apps to immich)
Like I asked, what is your actual threat model?
What are your requirements?
Is public accessibility actually required?