You best bet is not to use Nextcloud in the first place because it will eventually fuckup your data. Same goes for Cryptomator (just google it), it tends do lose files with long names or in folders with a large number of files. There are instances where the vault never opens again also.
A very important thing to consider is that whatever file backend you’re using it should support inotify and fuse-based stuff doesn’t support it. ecryptfs is a good option to encrypt the data, doesn’t fail and it isn’t fuse-based. It’s old however and may not be supported by every system/kernel.
Why can’t you just created a data partition and encrypt with LUKS? Not full disk, just your data partition? VeraCrypt is another option.