Update, I was able to get it working. My setup:
Docker network created by hand, called 'media_network': media server related stuff used by other containers as well
The wg0 docker network created by unraid when I import the tunnel using the guide from the link above.
I selected wg0 as the Network Type in the template for the container,
and added --net media_network to the extra parameters section in the template
This way the container will have two network interfaces and I can reach it from LAN, as well as it can use the VPN.
However, no matter the order of the network settings, in my case this given container always had the 'media_network' as the default route, meaning all internet traffic went through there by default.
To solve it I needed two commands:
# Delete default route through media_network
ip route del default via 172.18.0.1 dev eth0
# Set default route to wg0
ip route add default via 172.31.200.1 dev eth1
To be able to run these, you need to add to the template
--cap-add=NET_ADMIN
which should be ok security-wise.
To have it persist after container restarts, I created an init script for the given container, which was pretty easy, the container being a linuxserver image: https://www.linuxserver.io/blog/2019-09-14-customizing-our-containers
After all this, the result is that all internet traffic goes through VPN (wg0), while the container is also reachable from LAN and is able to communicate with other containers within the my docker network (media_network). The performance is suprisingly good. By using ProtonVPN and Wireguard, the bottleneck is actually my array, not the VPN.