It comes down to using secure passwords, 2 factor authentication, and updating software as soon as you can.
Check out Cloudflare's zero tier tunnel to only expose the services you need without port forwarding. Added benefit of masking your home's IP behind Cloudflare to prevent DDOS. Only downside is you need your own domain.
Get a dedicated NAS server with 3.5" drives for bulk storage. Used SAS drives on eBay are pretty cheap. Use iSCSI or NFS shares mounted to your bulk data directories for Nextcloud and Jellyfin. Buy some SSDs for local storage on the DL380 servers and use those as system disks for your VMs.
You could install Proxmox Backup Server on one of your nodes and backup the VM disks on SSD pool to the NAS and have a backup then.
Proxmox, Nextcloud, and Jellyfin user here. My setup separates groups of services into their own VMs. Docker is just another way to package and deploy applications by simplifying the process.
So Nextcloud and Jellyfin get their own VMs, and I deploy the applications via Docker on the separate VMs. If you want to utilize Portainer, you can deploy an agent to each of these VMs.
Lightweight applications I typically deploy to separate LXC containers. Portainer, Pi-hole, NGINX would all get separate LXC containers. You can connect to the other VM Portainer agents from the LXC Portainer server.
In the same boat. Barrier is the only software holding me back from switching to Wayland.
EDIT: Did come across https://git.sr.ht/~nickbp/nikau while searching. Looks fairly new. I'm looking for something that supports a Windows server though.