MongoDB - Stand Alone Server Security SSL or SSH
x.509 is, of course, best choice. You can get keys (for free) from let's encrypt organization if you "own" domain address.

Then there is keyfile what you can use.

Other choices are SSL tunnel or OpenVPN, latter preferred.