I am running a remote security camera based in a RPI3 using an 4G HAT (SIM7600X). I can confirm I cannot reach the ports directly (most likely to NAT).
So outgoing connections are no problem at least. I sometimes setup a temporary reverse SSH Tunnel (to be able to configure the camera using an UI). I personally used a VM hosted in a cloud for that (using nginx in between to be able to use https), but you might also use a self hosted machine for that (DDNS as you already).
To start the SSH tunnel ondemand I was using a telegram bot (+ telegramcli), this might not be suitable for everything and is by far not the best or secure solution, but for my usecase it was a good fit.
So a reverse SSH tunnel might be a solution for you?
Cheers!