This is what a CLB in AWS does. The load-balancer is globally-accessible which forwards the traffic to the instance. And nobody connects directly to the instance. Of course, you need to open a port on instance for load-balancer to access it, but you have to do that with any relay solution.
Are you interested to learn AWS ? Then check out AWS Certification Training Course by Intellipaat.