Yeah, I think you're confused 😉 There is no need for your friend to use a VPN to access your Jellyfin server. All you need to do is make it publicly accessible and tell him where to find it (the URL).

It can literally be as simple as setting up NAT on your router (commonly known as port forwarding, linking the IP of the Jellyfin server and it's port to a designated port on your router accessible via your public IP) and then giving your friend your public IP and the port that you opened. THIS IS HIGHLY DISCOURAGED THOUGH SINCE NOTHING IS ENCRYPTED.

It's best to setup either Dynamic DNS (usually free, but you don't get your own domain name, usually just a subdomain under their domain name) or buy your own domain name for cheap (like $10-$30 USD/year) and setup your A records (and CNAME records if you want) in the hosted DNS section. Once you have DNS working then setup a reverse proxy using something like Caddy (simple), Traefik (more complex), or Nginx (a full blown, complex web server) and Certbot/LetsEncrypt. SSL certs and reverse proxies can be a pain in the ass sometimes, but Caddy makes it dead simple.

From there just give your friend your URL (https://jellyfin.yourserver.com or however you have it setup). He puts that in the connection box in the Jellyfin UI and it should work as intended.