Best practices to design IoT product

[kolqa_]

Hello everyone, I apologize if I create a new topic in the wrong forum section.

I start to develop my own product which is used esp-wroom-32. I need some advice on how to correctly design my architecture and firmware and which protocol I need to use. I'm pretty sure that a lot of common patterns already exist.

Overall architecture:

A device that supports power on/off, set timer for night/daily use (turn off at night, start in the morning). Touch button, a motion sensor (If it in idle state and detect motion it's turned on). You can control this device remotely from the phone app (on/off etc) and from the touch button (only on/off)

Components: (if more detailed characteristic needed I can provide part numbers etc)
1. esp32 dev kit v1
2. Relay 5VDC (I connect some hardware to control power using this relay)
3. Touch button
4. Motion sensor.

IOS application (swift)
When we first time run our application it's asked to press the touch button for 7 sec on esp32, it will enable BLE to provision Wi-Fi credentials SSID + password. When I receive approve data to the application from esp32 over BLE its also contain some additional data
esp32 + mac_address (Right now I don't use it, but have some ideas) just save it in-app as a string.

What I already tried.
1. Setup esp32 as server and access it with HTTP requests (192.168.0.1/power/1 - turn on, 192.168.0.1/power/0 - turn off). From my phone application (written in Swift) I can easily send such request using IP address with requests like power, set_timer etc to control it.
Pros:
Easy to set up and use.
Cons:
Seems like such a solution is used only for homemade devices and not good production use since to access esp32 require the same wifi and you can't control from anywhere in the world without port forwarding. And I'm not sure that is possible to adopt such a solution to use apple home kit/google assistance in the future.

2. Using MQTT protocol
Run Mosquitto broker on my Host-machine with Ubuntu. Subscribe esp32 to a topic like /my_device_(esp32_mac_address)/power. When I provision wi-fi credentials over BLE using my phone app I also get esp32_macaddres and topic, it helps to send "change power" only for specific esp32 controller right now I have 5-of them.
Pros:
Seems in this case I can run Mosquitto/Vernemq on some machine that will act as a server and will work 24/7. It makes it possible to control my esp32 even from a different country (or I'm wrong?). Or I can purchase AWS IoT Core as I understand it's some kind of MQTT broker where all my devices will be connected. And as I understand a lot of modern IoT devices use MQTT protocol.
Cons:
I read that QoS 2 can handle up to 250 devices and 500-60000 devices will be a problem to it. If we talk about some cloud services you need manually add each new device to the cloud. Its means before selling my product I need to register it at AWS IoT Core (service is taken as an example) seems complicated, but maybe such services have some automated onboarding process, I don't know. For example, to prepare 10-20 devices for selling it's ok you can do it all manually but if talk about 1000-500000? I also read that MQTT is reasonable to use when you post a lot of data to the cloud, but I only need to on/off device + some additional features like enable motion sensor or disable + set timers to run it in morning or evening.

What I want to achieve:
As an example, I will takeMI bedside lamp 2, honestly, I don't even understand how they do it?
It can work with MI application or you can add it to the apple home (I know about the MFI license). It can work via wifi or 3g, 4G, Bluetooth, you can turn it on/off during your business trip to Florida. So how they do it? MQTT + Cloud services or HTTP REST requests using some kind of remote server to which the microcontroller is connected and when you use the phone app you send the requests to the server instead of the microcontroller.

I also think about some remote server to which esp32 will connect and all commands will be sent to the server to control esp32 but in this case, esp32 will be like a client without any httpd_register_uri_handler() so, how we can turn on the led from the remote server? Didn't find any examples of it. Simply can't imagine how to write the esp32 client part.

So the main question is which way I should choose and which is the most common one?

Any advice and opinion are appreciated. Sorry for the long read!