Create Access Lists

Connecting to NGINX-WebUI

Open and Login to proxy.yourdomain.com

Create Access Lists

Go to Access Lists
Click turquoise Add Access List-Button
Now enter the following values
Click Safe-button

Proxysettings

Names - Tailscale
Satisfy Any - false
Pass Auth to host - false

Add Access Lists

Go to Hosts > Proxy Hosts
Edit all sources that should only be accessible via tailscale.
Change Access List to Tailscale
Click Safe-button

Congratulations, now the changed IPs can only be visited with a tailscale client.
So make sure that each of your devices that should access the URLs have your Tailscale account.