Make sure your backups are solid and can't be deleted or altered.
In addition to normal backups, something like zfs snapshots also help and make it easier to restore if needed.
I think I remember seeing a nextcloud plugin that detects mass changes to a lot of files (like ransomware would cause). Maybe something like that would help?
Also enforce good passwords.
Do you have anything exposed to the internet that also has access to either nextcloud or the server it's running on? If so, lock that down as much as possible too.
Fail2ban or similar would help against brute force attacks.
The VM you're running nextcloud on should be as isolated as you can comfortably make it. E.g. if you have a camera/iot vlan, don't let the VM talk to it. Don't let it initiate outbound connections to any of your devices, etc
You can't entirely protect against zero day vulnerabilities, but you can do a lot to limit the risk and blast radius.
That makes sense, it does sound better to keep it within nixos! I've mostly been using nixos to bootstrap servers that run nomad+docker, so beyond the system-level config, I haven't done a lot with additional software yet.