Thanks for info. I should close this topic, as I managed to deploy regular NextCloud (not AiO) using Sophos Firewall VM as proxy. Works like a charm.
If anyone would be interested on “how to” deploy NC (or other) service behind real FW that recognize protocols in use, offers antivirus / antimalware for all data in motion + IPS and WAF - PM me