Thanks everyone for sharing your suggestions and insights (this is a very special community, and it's nice to be part of it). I've decided to try encrypted rsync to a Hetzner StorageBox via a CIFS mount. Others seem to be having trouble maintaining the mount with Hetzner Storage Boxes, so hopefully that doesn't happen too often. Even though there might be latency issues, I think this would be better than using a Netcup NFS mount, just so that the backups go to another provider from what the VPS is on.
@girish It would great if Cloudron could add more robust and nuanced backup options at some point. But I can understand that it's not priority at the moment (y'all are doing a great job with Cloudron).
@marcusquinn Your thinking on using the VPS snapshot does make a lot of sense. In my case most of the app data is on an Netcup NFS mount, so snapshoting the server wouldn't be very useful (I doubt the addon storage is included). So I've sort off flipped that on it's head, and will try doing daily rysnc backups (retained for a week) and then weekly automatic snapshots on the Hetzner Storage Box (you get a certain number free, depending on storage capacity). This doesn't have the effect of conserving VPS resources, but should extend the backup range without adding to storage costs.