After a little more thinking I would like to suggest the following setup:
Should work that way, but do not have a setup at home to test.
This way the obfs4proxy does not know its public IP, but will take the ORPort as public IP. It is not open for the public but in the non published descriptor. Please try if you like and report back, if it works for you or not…