Use a VPN connection. Synology’s knowledge base recommends using a virtual private network (VPN) for secure remote access to data on your NAS via SMB, and notes to avoid exposing CIFS/SMB ports to the Internet. It also lists QuickConnect, DDNS, and port forwarding as remote access methods, but for secure access without opening NAS services directly, VPN is the recommended approach.
Sources used: [5], [7]