Using a VPN does work for restricting outside access, however I found that for me this was not convenient enough for two reasons:
- I would need to setup a VPN server at my home network
- I would need to connect to my VPN everytime before trying to access my smart home devices
Since I am on the same journey as OP and tried it just recently, I have one thing to add about openHAB:
It does not come with actual login credential handling. If you want to make your smart home accessible from outside your home network I cannot recommend openHAB.
I am currently going with Home Aisstant mainly for that reason.