It sucks, but as someone who hosts their own services and supports business clients: If they have a budget, Office365 all the way. Does it suck paying money to M$? Oh hell yeah. But it’s a ‘cost of doing business’. Don’t screw around if they can afford it, just go O365 :(
Can you share what the final desired goal is? It sounds like your goal is actually to provide your services to Bob securely over the internet, is that a fair description? You mentioned eventually grabbing a domain, how do you feel about publicly exposed services with authentication? For instance, I use authentik in front of Jellyfin and paperless myself for a little extra authentication juice.