After realizing what a subpar idea I wanted to realize, I changed the posting.
Finally I managed to get it up and running. I followed strictly this manual (https://support.nordvpn.com/Connectivity/Router/1292598142/OPNsense-19-1-setup-with-NordVPN.htm).
After successful configuration of the VPN I only opened access from my main subnet (WAN) to the LAN, not the other way round.
Out of LAN is only possible over the VPN, what is the basic idea of the whole thing anyway.
Hence, I change the posting. It hasn't to do much with the original plan anyway.
Thanks for reading.