I currently keep everything LAN-only because I haven't figured out how to properly set up outside access yet.
(I would like to have Home Assistant available either over the Internet or via VPN so that automations keyed off people's location outside the home would work.)