Open a port or if their router supports it, assign their device to a DMZ.

Why do you think it’s risky? Maybe we can talk about ways of securing it.

Like any server, it’s as safe as the server software (and its configuration).