2) https
I'll continue digging into it and will paste the solution, If found ;)
3) found https://help.liquidweb.com/s/article/Allowing-Port-Access-by-IP-Address-in-CSF and I'll use
protocol:in:d=8069:s=IP
that works lovely. I've limited access to Odoo to selected IPs only