EDIT: My suggestion probably doesn't work for your use-case, but I'll leave it for anyone else....
I use this to only tunnel the ports I actually need: https://github.com/DigitallyRefined/docker-wireguard-tunnel
My CGNAT'ed home PC is the client, and my public-facing Oracle Cloud instance is the server.
I've tried and failed miserably to use the "official" Wireguard container. Once I start reading suggestions to modify iptables outside of Docker, I know I'm in trouble.
You see the screenshot.
Now assume your Angry Internet Gamer position....
Get in the comments, and FIGHT!