You have two likely issues to overcome. The First is that letsencrypt REQUIRES port 80 for certbot validation, Unless you can control your DNS to perform DNS authentication. they disabled HTTPS validation some time ago.
This is the part that makes the above part obnoxious. Port 80 on just about any ISP for the last 30 years has been blocked. Sometimes you can get it turned on for business accounts, sometimes on a home account for WFH type purposes. but rarely without a cost. This will the foul LetsEncrypt in a big way for their normal validation.
With your DDNS provider it will vary depending on what your provider is. Google has great DDNS support. Dreamhost, not so much.
DDNS is ususally what will be used for a system that is on DHCP and will need to have its ip/dns records updated. CNAME is for a redirection of Domain A to Domain B (No IP).
Here is the fun voodoo of a modern webserver. Apache and nginx both do this well. You can put up one of those web-servers and use it as a web-server. and then use a reverse proxy from that server into a website or location on another machine that is not exposed to the internet. So your NAS is now behind a location on your main server. IE your network is
homedomain.org and your webserver responds to it. your NASis behind your firewall, but you set up a reverse proxy on your webserver so now
homedomain.org/NAS goes directly to your nas device's web page. If you have more DNS and DDNS tools available you can create
nas.homedomain.org and tell your webserver to talk all
nas.homedomain.org traffic and redirect to "webiste" A wich is a reverse proxy to your NAS and then all other traffic si handled by "website" B on the server itself.
I have had limited success with this because I am very new to this. But it is an interest learning process and you learn a great deal about webtraffic and the like.
A mouse trap, placed on top of your alarm clock, will prevent you from rolling over and going back to sleep after you hit the snooze button.
Stephen