Wireguard has a dead simple onboarding process as well. For users you want to grant access - providing a QR code and them installing the wireguard client app on their mobile device is all that is needed. Also wireguard server itself is a easy setup and has very little overhead. Took me like few minutes to install and setup on a raspberry pi 3. Of course, you do have to open up a port on your router. That's the only downside. I've since switched to Tailscale for that specific reason.