It’s an extra layer of security. Your nextcloud instance won’t be reachable from anybody who isn’t on your vpn, if a bug which allows unauthorized access gets discovered you will be protected, if they steal your nextcloud credentials you will be protected, but if you’re on a device without the vpn you won’t be able to access nextcloud. As for the domain you can buy a random xyz for a couple of bucks per year so just do it