How to disallow HTTP access to gui?

No, the warning is normal because you use a self-signed certificate. That's totally normal.

If you use DDNS as well you can try this one: How-To: Let's Encrypt on GLDDNS domain