That is explicit. Now that I think about it, I should update the article with how I do it now.

I explicitly bind the external port only to the ZeroTier interface. In fact, my configs have changed a bit:

instead of:

    ports:
        - 5432:5432

I now use the IP of the zerotier interface:

    ports:
        - 192.168.111.123:5432:5432

Now the only way to reach that port is via the vpn.