How does one go about holding a US based company accountable violating an EU law that they aren't required to comply with?

This is my favorite method. It doesn't require you to open any ports and minimizes your potential attack surface. You can either install zerotier on each host you want remote access to, or run an instance of zerotier in bridge mode which is essentially acting as a VPN.