My advice: only forward ports 8080 and 443, then make sure that you have fail2ban or crossed properly set up on your reverse proxy. After that, you are pretty much fine as long as you keep on top of updating your containers.
I would be careful about which apps you proxy. Idk why you need to access the admin portal for pi hole worldwide. If you really want to do that, you should set up a vpn.
I asked this exact thing somewhere else, and the best answers I got were:
So, as per usual with Linux, there are some obscure and historical reasons this is a thing, but it is useless for the majority of users. Fedora should really not have it configured as the default source for flatpaks out of the box