It depends on the trade-offs you want to make. If you want to maintain one less Nginx install with a little more risk, that’s a way to go.

If your priority is security, use a separate proxy for your private services and do allow your public VLAN access into your private VLAN.

My home network only has public services on it right now, but now you are making me think I should segment it further if I want to host any truly private services there.