I saw this article regarding limitations of Home Assistant external access. I think there are at least two things you can do:

• (If Apache is front-ending HA) Use mod_security / SSHguard to catch common attacks
• Require mTLS for external client access