I’ve used wireguard for a few years. The container isn’t essential, but I prefer to have all my service configs contained and separate from the host OS.

So basically you’ll just have one WAN->LAN port forward for Wireguard. Connect to that remotely, and you’ll be able to access everything inside your LAN.