Assuming you actually want a NAS and not cold storage, I’d recommend at least some kind of raid to account for disk failure.
As for ransomware protection, one decent solution is snapshots and limiting every client to only be allowed access to their own backup directory, or a limited set of directories in general on the NAS, as well as no execution permissions in those directories.
If you’re concerned about the NAS being directly infected by a malicious user with direct access and execute permissions, the only real solution is offsite or cold storage backups.
Assuming you actually want a NAS and not cold storage, I’d recommend at least some kind of raid to account for disk failure.
As for ransomware protection, one decent solution is snapshots and limiting every client to only be allowed access to their own backup directory, or a limited set of directories in general on the NAS, as well as no execution permissions in those directories.
If you’re concerned about the NAS being directly infected by a malicious user with direct access and execute permissions, the only real solution is offsite or cold storage backups.