Use a reverse proxy in a DMZ. You can use something like Bunkerweb + Crowdsec to give you a WAF and dynamic IP blocklist in front of your web service.
Can't you map Alt-Tab to one of the back buttons? Or does that not work in desktop mode?EDIT: Or if that doesn't work through steam then is there gamepad software in KDE or the Software Centre that lets the desktop map gamepad buttons?
I'm using Mullvad at the moment as well and looking to change for the same reason. I've been looking at switching to AirVPN once all my credit runs out on Mullvad. They have a similar model to Mullvad, but they allow port forwarding.
Use a reverse proxy in a DMZ. You can use something like Bunkerweb + Crowdsec to give you a WAF and dynamic IP blocklist in front of your web service.