In my case, I don’t use the duckdns addon at all. My router does duckdns but on my NUC I have a different domain and just use a script to update DuckDNS (only updates IPv6 address) and use LetsEncrypt via Caddy.
In actual fact my IPv6 address is static but I still use it for external access via a duckdns domain.
Also, Caddy is a reverse proxy so I actually only open 443 and 80 but can access all Hassio addons like configurator, tasmoadmin etc without extra ports…