Yes, always use HTTPS, even on local networks if there ever are more than one device on the network.

The way to handle services with/without HTTPS is to put everything behind a reverse proxy that automatically handles certificates. Since you’re using NGINX, you can try setup certbot, or switch to something like Caddy that has certificate handling built in. If you have all your Docker containers on one server, you can look at Traefik.

One could fairly argue that maybe such people shouldn’t have access to a system, but it is a reality.

More that, such people shouldn’t be allowed to be sysadmins, yet self-host and/or expose any ports to the internet.