wireguard tunnel, carve off an lv on his network, expose it as an ataoe/iscsi/whatever device over wg, connect it on your end, write a luks volume to it. periodically connect, unlock, mount, rsync all your shit to it, unmount, lock, disconnect?

or just create a gpg'd backup set and rsync it over wg? or just rsync over wg if you dont give a shit about encryption or anything.

You can connect your main server and backup server to a VPS with wireguard. The main server backs up proxmox vms and cts to a proxmox backup server on the backup server. Nextcloud data can be backed up with something like duplicati encrypted over sftp to the backup server. Only hiccup about backing up Nextcloud is you should put it into maintenance mode first. You can write a script pre duplicati backup and post backup to enable and disable maintenance mode.

Tell us a bit about your environment! Are you all linux or do you have Windows as well? Are you running a hypervisor like Proxmox or VMWare or using containers? Are you just making complete backups, or can you forsee yourself needing granular file restores? There are a number of ways you could go, depending on your setup.