As far as I know it should work just fine to move ncp to docker, set some different ports on the outside of the container and as you said, add the nginx proxy as a trusted proxy, then setup nginx to forward the request to the docker container with the proper headers.
It should work as normal once everything is setup correctly with the DDNS for the proxy, that now needs to handle the certificates instead of ncp, any requests for a new certificate should be made from your proxy.
This is how I’ve used it with caddy as a reverse proxy where caddy handle the certificates instead of ncp.
It should be possible to configure it so the proxy doesn’t handle the certificates but I haven’t done it that way, so I don’t know how to do that properly.
Also, if you can’t make the reverse proxy ignore the TLS verification you’ll need to turn off the http → https redirect in ncp (you can do this in the config.php or admin web interface at :4443)
Here is another topic about this you can read with a bit more info from various people that also using nginx
And here is the documentation for Nextcloud with a reverse proxy