Why are you mounting the volume with the file system path, instead of the volume name? You should be able to mount the volume normally by specifying it in the volume section, i.e.

services:
  duplicati:
    volumes:
      - nextcloud_data:ro

volumes:
  - nextcloud_data
    - external: true

That should grant Duplicati read-only access to the entire volume without messing around with absolute file paths.