But I’m a bit lost which approach and tools to use without exposing and making my NAS vulnerable on the internet.

You’re looking for a reverse proxy;

*.domian.dev {
        encode zstd gzip
        @jelly host jelly.domian.dev
        handle @jelly {
                reverse_proxy {selfhost_ip}:{port}
        }
        @ping host ping.domian.dev
        handle @ping {
                respond "pong!"
        }
}

Running caddy like this directly connects your jelly.domain.dev domain to your selfhost ip on a specific port. From within your selfhost you ensure that you’re only allowing in the IP of the VPS, so no one can else can directly connect.

Works great.