I used WireGuard VPN for my setup so I don't have anything exposed directly to the internet. Just a matter of opening up the UDP port. WG is secure; I have a separate DDNS server that updates my A record whenever my IP changes.

Personally I like the Dell Optiplex Micros. You can scoop up a 7040 or 3040/3050 pretty cheap. I found mine refurbed on Craigslist for like $70 a pop and put together an HA cluster. As far as specs go, as long as your chip supports virtualization for Proxmox, you should be fine. Everything else is pretty much up to you.