Placing custom php file in root directory, or skip file/dir when updaging/upgrading

I would like to place custom php file in different directory than root and make it served like it is inside root directory. If it is inside root directory, then updating/upgrading nextcloud is impossible without removing it first. php-fpm is chrooted.
Sucuri needs its server side scanner php file is placed in root directory. However nextcloud can’t be upgraded with such file inside root directory.
Can you show us apache config in this regard? Or is it possible to make upgrade/update process skip custom php files/directories?

thanks,