Tailscale is a VPN type service that uses WireGuard as its underlaying VPN technology, but I don’t know enough about Tailscale to provide any specific answers to your question.
As long as you have a secure connection via TLS, you have as a secure connection to your NAS as is possible on the internet today.
I have a public IP address, so I simply use WireGuard on my router to access parts on my network that I don’t want facing the internet. I’ve also set up a reverse proxy using Zoraxy. I wrote up a little guide here if you’re interested, but it requires that you have a DDNS service of some kind. It’s a fairly secure way of accessing your services remotely, as long as those service have their own login function. It limits you to only having to open two ports on your router as well. There are other proxy server options as well, this is just one that I found to be relatively easy to use.