Ugh, I hate it when tools to “simplify” an already relatively simple process actually oversimplify it to the point of making it horribly complex to work around their “simplification”. A few points I’d like to answer from your post:

• Nginx-Proxy-Manager is dumb for, as far as I can see, not allowing you to follow the standardized method of answering challenges that supports any DNS provider and instead only seems to allow its “magic simplified process” that only works with select DNS providers
• https://dns.he.net/ is a nice free DNS service that you could use for your “keep domain at bluehost but use DNS servers elsewhere” strategy, and this is a totally valid and reasonable configuration – however, it apparently won’t help with Nginx-Proxy-Manager due to above stupidity
• This leaves your only DNS hosting service option as Cloudflare, as you correctly identified. This is a fine option but you know what they say about free services especially when they’ve got big for-profit companies behind them, if you’re not paying for the product, then you ARE the product, so beware of becoming vendor-locked and enshittified when they inevitably decide to try to monetize you somehow (if they’re not already doing so behind the scenes).
• Yes you can transfer your domain to a supported provider. This is kind of a “nuclear option” to get it to work with some shitty web-UI like Nginx-Proxy-Manager just because they’re too lazy to support actual standards or play nice with manual configurations, but it’s straightforward, albeit a little bit slow process (can take several days for things to switch over)
• There is no “renewal cost” for transferring a domain other than having to pay for 1 year minimum of the new provider’s normal annual registration costs. This gets added to your existing expiry, generally speaking, or your old time gets refunded, so either way you’re not losing anything, however things can get complex if you’ve only recently registered or renewed it, for example

If you’re very happy with Bluehost and want to stay there (I have no idea if they’re any good I’m not familiar with them but I will say charging $90 for an SSL certificate seems a bit absurd) then Cloudflare is probably the path of least resistance.

If you don’t mind transferring your domain and waiting for that process, that’s also a good approach.

But personally, I would drop Nginx-Proxy-Manager like a hot potato and work your way through setting up something like Caddy instead, doing mostly the same magic that NPM does (unfortunate acronym for anyone who’s more familiar with Node Package Manager) but using a very open and flexible system, supporting plugins for different providers to support DNS challenges for example

One final option that I’m going to throw out there, is if you intend on connecting your web server to the public internet anyway, and you’re able to live without a wildcard DNS (this just means it has to create a different certificate for each subdomain you add, not a big deal when a program is already managing them for you in my opinion) then you can just forget about the DNS challenge altogether and use a regular HTTP challenge. Again, fully standards compliant. Doesn’t matter what DNS or web server you’re using. As long as it has an internet connection so it can talk to the encryption certificate server and verify that it is who it says it is, you’re good to go, no need for DNS keys and such. Frankly I find the HTTP method just as simple if not simpler in most cases. Again, they’re oversimplifying to the point of making it more complex.