docker containers reverse proxy access but for LAN access instead of external/remoteaccess?

I have seen many reverse proxy guides, but it seems they all cover for remoting into your docker containers exposed to the internet then securing them with reverse proxy authentication. This seems insecure since if someone got access to your LAN they can bypass your reverse proxy authentication and directly access the docker containers using their IP:port as your docker containers are exposed to the host's LAN network.

Is there guides for when you already have home VPN access to your LAN remotely using unraid's own wireguard, and then securing your docker containers behind a reverse proxy authentication? But having your docker containers not exposed to your LAN network, only an internal docker network. This would be suitable for when you are sharing internet connection with other untrust users on the LAN.