Best way to enable external access to QNAP services + automatic SSL certificate renewal

Dynamic IPs are easy to work around. First of all your QNAP has a built in DDNS client that you could use to connect to your external IP for the external domain name. Many routers these days support that as well.

I absolutely love my MikroTik router as it has a DDNS built in for the router itself and the WireGuard VPN is very easy to set up and as long as you copy everything over correctly it just works and works really well.