But it should not need write access to those files.
I bet it is due to different UID. Nextcloud runs with the www-data user, and UID 1000 is likely whatever user OP set up on the host machine. Make Duplicati run with the same UID as nextcloud and it will have the permission to read the files.