Secure MSSQL API Connectivity

I need a developer who can expose my on-premise Microsoft SQL Server to both our office network and the public internet through a hardened API layer.

Scope
• Build or configure an API gateway/proxy that sits in front of the database.
• Internal requests should be allowed automatically once my companion application passes a single “safe word” to the gateway.
• External requests must trigger a time-based one-time-password flow—Google Authenticator (or a comparable authenticator app) is preferred. The system should remember a validated device or browser for 24 hours to avoid re-prompting every call.
• The API must handle both sensitive and general data, so transport encryption, parameterised queries, and input sanitisation are mandatory.

Key goals
• Zero direct SQL exposure to the public internet.
• Clean, documented endpoints (REST or GraphQL—open to your recommendation).
• Role-based access so future services can be whitelisted easily.
• Clear setup scripts and instructions so I can redeploy in staging and production without guesswork.

Please outline the stack or gateway tool you propose (e.g. .NET Core, Node.js with Express, Nginx reverse proxy, Azure API Management, etc.) and any experience you have with MFA integrations.