Better Mac VNC protection

Since my Mac server is sitting in the closet, I would need to enable Screen Sharing / VNC to access it remotely via VPN (outside) or local IP. However, I don't like the fact that it advertise on the network (which is as secured as I can make it) and doesn't have any 2FA. There is a way to make SSH tunnel but it doesn't **require** **SSH,** only optional. Any advice?