Containers, unless you have a specific need for a VM.
With a VM you have to reserve resources exclusively. If you give a VM 2gb of ram, then that's 2gb of ram that you can't use for other things, even if the guest OS is using less.
With Containers, you only need as many resources as the process inside the container requires at the time.
With nextcloud you can create shared folders. You can give him access to the shared folder via his own account. Anything put inside the shared folder is available to you both. He won't be able to access the rest of your stuff.
Unless he has admin access to the server itself. But you can also enable encryption.