If you want the portal to appear under /portal without leaving the domain, that requires a reverse proxy (Worker) and is usually not worth it because of auth + headers.