For instance how can I use my *.domain.com SSL certs and NPM to route containers to a subdomain without exposing them? The main domain is exposed.
If you have wildcard certs, you just install them everywhere your services are running.
As far as redirects go, you just 302 redirect from one host to another.
Unless you’re asking about resolving hosts on your internal network and public ones differently, which is a lot more complicated than you probably want to deal with if you’re already kind of lost. Just setup a VPN to your internal network and be done with it. Otherwise setup a local DNS resolver to bridge your public DNS and local requests.