Looking for References on Best Practices for Secure Docker Networks

Hello,

I am getting close to "go live" with my stack and I've come across a lot of references to custom docker networks but the "how-to" I've seen just show adding the new network in settings and configuring it for your containers. I don't understand the benefit of this, it was mentioned that hostnames could then be used instead of IPs which would be nice but I'm also interested in security. I don't quite understand why each docker would have a different host name here, do they no longer share an IP? Wouldn't you still need to specify a port? 

Right now I am using the binhex-sabnzbdvpn container. Would it be better to create a custom network with a VPN associated to it and use that indead of this container? Would I then need to somehow bridge that network to another customer network running the other dockers without VPN? I am currently using Nginx Proxy Manager which took a while to get setup and I want to make sure I understand what I am doing before I make any changes.

Also I configured my VPN to New York City because it was close, but I've read it's better to configure to somewhere with less traffic. Does distance not matter for VPN performance? How do I select an optimal location for it, I noticed my downloads in sabnzbdvpn seem slow. 

Finally, I've seen mentions of vLANs. My understanding of these is that you'd set them up with managed switches / routers / APs so different devices could be on networks isolated from other devices. For instance you'd use a vLAN to keep your security cameras off the network. When this is referred to in the context of a docker network are they all just vLANs?

Any guides / documentation / videos around these topics would be much appreciated. I want to make sure everything is secure and things that need VPNs are using them correctly before the big server reveal party! 

Thanks!