Another approach would be to add, to the docker image, a dedicated HTTP reverse proxy to handle HTTP3 traffic and only that. E.g, you could embedd say Envoy Proxy - which supports HTTP3 ingress - and configure it to listen only on port 443/udp for h3 traffic, and transform all incoming h3 requests to h2 or h1.1 and forward to the Nginx instance.
A bit of a hack though, so won’t say it’s a good idea. 