I’m a fan of pulling backups instead of pushing as in my mind that helps with air gap.. if you run your backup service from a VM you won’t have direct pool access as VMs work with shares.. set up a jail, give it a dataset to write too and run a schedule in TrueNAS that triggers the service in the jail and performed snapshots on the dataset, something like this;
1. take snapshot of dataset
2. trigger rsync to pull the data from the server
3. clean up old snapshots
4. write log
5. repeat
this way there is nothing that some malicious software on your server can do to the backup