Even though I liked your post due to DuckDNS/dynamic DNS recommendation, I would not connect any 3rd party IOT devices to the net if possible. Especially, if the device does not support encryption out of the box. At minimum, I would put the Pi (mentioned by
@sorex) between the bulb and the internet and only have the pi communicate with the internet. Even then, I would have a very narrow scope of actions on the Pi that are accessible over the internet and then all communications should be encrypted (HTTPS for example). Don't try to roll your own encryption, since encryption is hard and badly implemented encryption is easily circumvented. Please note that anything you expose to the internet, someone will try to hack.