I have also heard that you can bind your hypothetical torrent client to your hypothetical VPN network interface meaning it would be unable to even send out any data if the VPN was not connected.
Or in the case of docker use a prepackaged VPN+Torrent container or pipe all container network traffic through a VPN container like gluetun
Also in my experience the raspberry pi isn't all that great for a NAS considering you are reliant on using USB hard drives and also need a separate powered USB hub for them