I've found drop (https://github.com/wrr/drop) to be really simple and effective.

For full isolation, I also use a VM via Incus. Lets me run the dayjob's Tailscale within, as well.