I honestly wonder what you’re expecting. If I look up the definition of a VDR on Wikipedia, it says:
A virtual data room (sometimes called a VDR or Deal Room) is an online repository of information that is used for the storing and distribution of documents.
That’s exactly what Nextcloud already does out of the box, isn’t it?
The very next sentence then starts with “In many cases …”, which tells me that “Virtual Data Room” is first and foremost a buzzword that’s used in different contexts, and that the actual requirements for a VDR can vary significantly depending on the use case.
What is almost always required, though, is some kind of access control and permission system, and Nextcloud already provides some of this out of the box via its file-sharing capabilities, which can be extended with apps like File Access Control, or Guests.
A very common use case for a VDR, according to the same Wikipedia article, is this:
In many cases, a virtual data room is used to facilitate the due diligence process during an M&A transaction, loan syndication, or private equity and venture capital transactions.
You’re not seriously expecting consulting from this forum on how to set something like that up in a legally compliant way, are you? 
In any case, if you want any meaningful advice on how to build a VDR with Nextcloud, the first step is to clearly define the intended use case. You’d typically start with a list of requirements, and based on that it should become clearer which Nextcloud features and apps are needed to meet those requirements.
This article should give you a few pointers: https://nextcloud.com/blog/nextcloud-announces-virtual-data-room-solution-for-ultimate-protection-of-data-during-sensitive-dealmaking/