Can you choose to only allow remote access to certain apps with Tailscale?

I want to be able to access apps like Jellyfin remotely, but I don't want to be able to access other things like my SMB share remotely, because I just never need to. I've been looking at Tailscale, but it looks like that allows you to access everything remotely, but maybe the tutorial I watched just got me confused.

Is there a way of just being able to access certain apps securely, or is this not possible? I've seen people recommend against port forwarding, so that's probably off the table.

Also, one of the apps is a Minecraft server that I'm hosting for a club I'm part of. Obviously everyone there is a friend of mine, but it's still "public", so are there any precautions I should be taking? This seems random, but I figured that since I need to focus on securely hosting a Minecraft server, I may aswell do the same for the other apps that I'd like to use when I'm not at home.

Thank you :)