We do not need nginx or apache to only allow a range of network. Traefik can do it alone but I bet experimentation must be done manually
Relevant to wireguard I think yes it could defintively works but the pki will need a lot of love. Without it you need to manually create and distribute your keys manually among the clients et and the server. Not really handy