Sorry in the haste I forgot about that one. Though we usually make the redis user a member of the www-data group:
$ usermod -g www-data redis
with 755 on the rundir (/var/run/redis-nextcloud) and 700 for the socket file itself (redis-server-nc.sock in our case since we are running multiple redis instances for different services on our servers).
But obviously either way works.
Thank you for pointing this out, @bb77 