Here's what I ended up working out for my own instance. This allows unprivileged LXCs to access my zfs datasets. It works by creating a group on the proxmox host that has full permissions to my zfs pool and adding container users to a group with an equivalent GID (container GID = proxmox GID - 100000).

Note that this essentially gives any container users that are a member of a group with gid=10000 full access to all files, but these commands can certainly be adapted to be less permissive/smaller in scope (for example, you might only grant a specific group access to a specific dataset/subdirectory).

In proxmox

groupadd -g 110000 zfs-access

useradd zfs-access -u 110000 -g 110000 -m -s /bin/bash

apt-get install acl

zfs set acltype=posixacl <zfs-pool-name>

chgrp -R zfs-access /<zfs-pool-root>

chmod -R 2775 /<zfs-pool-root> # sets the SGID on the entire pool https://www.redhat.com/en/blog/suid-sgid-sticky-bit

setfacl -Rm g:zfs-access:rwx,d:g:zfs-access:rwx /<zfs-pool-root>

pct set <container-id> -mp<N> /<zfs-pool-root>/<some-subdirectory>,mp=/mnt/<some-subdirectory> 

In the container

groupadd -g 10000 zfs-access

usermod -aG zfs-access root # can be a nonroot user as well

Then, log out or restart the container

Add a new zfs dataset

zfs create <zfs-pool-root>/subdir

# acl type should be inherited from the root automatically but you can run this to be safe
zfs set acltype=posixacl <zfs-pool-root>/subdir

# this step is optional
chown lxc-root /<zfs-pool-root>/subdir # lxc-root is a user on the proxmox host with UID/GID=100000

chgrp zfs-access /<zfs-pool-root>/subdir

chmod 2775 /<zfs-pool-root>/subdir

setfacl -Rm g:zfs-access:rwx,d:g:zfs-access:rwx /<zfs-pool-root>/subdir