

a wireguard tunnel over a forced NordVPN tunnel will mean that all his traffic will flow all the way to the NordVPN node and all the way back for a LAN connection.
a properly configured wireguard tunnel is harder to configure than a tailscale network with a mullvad exit node. (I think)
a wireguard tunnel can only connect one device to the Jellyfin Server (or router if it supports it)
I solved a similar situation with a tailscale subnet router . a tailscale subnet router is a tailscale node that exposes the non-tailscale network to the tailscale network. This way I am able to access one of my routers (and its PBX) from all tailscale nodes. The android phone has only tailscale as a VPN. If i pay for mulvad I can have the rest of the traffic go over a mullvad node.
doesn’t really help you here though, unless you install protonVPN on the pi and add that as a tailscale exit node.