For instance how can I use my *.domain.com SSL certs and NPM to route containers to a subdomain without exposing them? The main domain is exposed.
OP is asking for cases where you don’t want to allow the service (or reverse proxy) to be accessible via the web.