Is keeping everything inside of a local “walled garden”, then exposing the minimum amount of services needed to a WireGuard VPN not sufficient?

There would be be no attack surface from WAN other than the port opened to WireGuard

I saw quite a few people sitting outside their houses with their candy ready for the kids. Some even organized them on tables so the kids could come up, pick one, be handed it and go.