a wireguard tunnel over a forced NordVPN tunnel will mean that all his traffic will flow all the way to the NordVPN node and all the way back for a LAN connection.

a properly configured wireguard tunnel is harder to configure than a tailscale network with a mullvad exit node. (I think)

a wireguard tunnel can only connect one device to the Jellyfin Server (or router if it supports it)