I'm also interested in this. Also evaluating Unraid at the moment to replace my docker server on esxi.
In my previous setup on a ubuntu host I created a folder structure for every docker app that I use. A global reverse proxy was used to make all apps available with a external network in docker. That network was reused in every app (docker-compose). The only thing that I had to do manually was a letsencrypt cert renewal since I used a *.wildcard.ext domain internally. This uses a DNS validation and does not require you to open port 80/443 to your internal server.
So also this setup is stricktly used internally, external use only trough vpn (nextcloud sync).