Navidrome is another server that works pretty well, implements the subsonic protocol ( so all the apps that can cache and stream to your mobile device work). You can have multiple logins, or just share out playlists and albums individually to non-authenticated users.
Subsonic is also a protocol (and opensubsonic) which supports many other clients, if you want. Personally my music collection is just hosted on gonic, a server-only subsonic implementation and I stream it to whatever clients I want.
There have been a few mentions of Navidrome. I find it works well for sharing at an album or even artist level. It can do playlists as well. But you must explicitly choose what to share, at which point it's generates a unique URL and will generate a web player and zip if you enable the option to download.
You can, of course, just make user accounts and distribute credentials.
If you're needing to offer browsable folders to easily copy, basically a filesystem-like experience, it's probably not the best tool.
Edit: one more thing to point out is that navidrome, jellyfin, and airsonic all construct music libraries differently. Navidrome is using tags, jellyfin uses file names, airsonic uses directory structure. Not sure about Plex.
Then I would approach it as just regular file syncing. Syncthing is probably the most popular piece of software, though I haven't used personally used it over the Internet.
If you don't want to sync every file, perhaps your NAS has a native desktop file sync client? Or I'd run something basic like Filebrowser and let them download the individual files/folders they want, though it doesn't do syncing.
Imho easy mode is just throwing it on Plex and making sure your port is set up on your router for external access, then just sharing your music folder in Plex.
I don't know why people are recommending apps like Navidrome and Jellyfin when it isn't a music server that you're looking for but a way to share the music collection.
With that said, I can think of 2 approaches, and (likely) the easier option will be to use the help of such a server. Both will require a VPN server in the cloud which will be redirected via NAT/reverse-proxy into your network.
Use something like Navidrome with LDAP/Auth solutions like Authelia. User has to authenticate themselves to access their account on the service like something in the cloud.
To offer more barebones access to the underlying storage directly: set up NFSv4 for Kerberos.