Ok. There are any number of ways to do this.
You could use Synology Drive and use the client app's Backup task, selecting an encrypted connection. Drive is the successor to Cloud Station which you may have used before. There are Sync tasks which can behave like Dropbox, but the Backup task will maintain a versioned backup of the selected Mac folders. For Mac and PC Drive client apps this needs TCP 6690 forwarded at the destination to the NAS, so best use the NAS's firewall to restrict where connections can come from (e.g. your country).
I wouldn't use Drive's Sync task to maintain the copies on the NAS, because:
- They are probably big files.
- If you delete on the Mac it will delete on the NAS, and the versions too.
I would also try to only backup finished files, or not changing often, since versions take up space. Though Btrfs helps. Also, you can set a limit on the retained number of versions for each NAS shared folder that you enable in Drive Server: the Backup task uses people's home/Drive/Backup folder and so the limit will apply to this and their personal files that are tracked in Drive (i.e. any Sync tasks to their home/Drive items).
You could use VPN Server and then use Mac's builtin L2TP VPN capability (or OpenVPN client, Tunnelblick is probably the most common). This would then provide direct access to the NAS and you can then connect using SMB (Windows file sharing, AFP, etc). Then you can use third party backup/clone apps, or even Time Machine (??. Never tried it over manually initiated VPN connection).
Have a read up on Synology Drive to see if it fits with what you want to do.