Private Game Server, ELI5 Headscale vs Tailscale

I self host an Enshrouded game server for me and a couple friends. Currently it’s on Tailscale with my friends using Tailscale client to connect to my tailnet and access the game server.

I have an ACL setup in Tailscale to only allow the people (users) invited to my tailnet to access the server and only on the 2 ports it uses.

I’m doing this on the free account and it has a limit of 3 users, which I will hit and have a 4th person who may or may not play in the near future.

I am considering Headscale as an alternative but am unsure if it’s able to fill the role Tailscale does for me and do so securely, without me needing to open ports on my router.

Does Headscale still run things across Tailscale network(s)/infrastructure? Is there anything above (ex: ACL) that Headscale cant do that my current setup does?