Lets Encrypt should be fine issuing a cert on a FreeDNS hostname using the HTTP-01 challenge, I believe you may also need port 80 open?
The basic steps would be install a letsencrypt client on the NAS, issue a cert for the FreeDNS hostname, then give that cert to jellyfin directly or to a reverse proxy sitting in front of it.