The comment above is accurate how domain names can be passed to Nginx that would resolve to private IP addresses. But that doesn’t mean they need to exposed. Nginx has a listen directive that specifies what IPs are listened on. So If your Reserve Proxy has both a public IP and private IP. then the private services can have a a listen directive like this:

server {
  # Whatever your proxy's private IP is
  listen 10.0.0.1;
  server_name my-private-service;
}

No matter what hostname is passed in, Nginx would only reply to requests that can reach the Nginx host at it’s private IP address.