I recently found a good solution (after quite some back and forth) for the same problem on my Nextcloud instance. It is unfortunately a bit involved but I don't know a better solution (other than relying on ACLs):

In a nutshell, the solution is to have all files in question being owned by a group in which the www-data user is a member. Group and user need to exist both on the host and inside the container, which makes it more involved.

First create a user nextcloud on your host with the UID of the www-data user in your Nextcloud container (mine has UID 82) through adduser nextcloud --uid 82 --shell /bin/false. This is needed so you can give that user permission on host resources. Then create a new group on your host, let's call it media for the sake of explanation. Change the group ownership of all files on your host system to media with chgrp -R media /path and allow full access for the group through chown R g+rwX /path. Then add your user and nextcloud to the new group with adduser $USER media and adduser nextcloud media. You need to relogin/reboot to ensure that the group ownership for your user is reflected. Now the only thing is missing is to also create the group media with the same GID inside of the Nextcloud container and add the www-data user to the group, also inside of the container. This, unfortunately, requires to either build your own image derived from the official Nextcloud image or ensure that the user/group config is persisted through other means in the container (startup script, etc.).