Another option instead of the DNS Challenge ...
Are you able to set your firewall to block everything arriving on port 80 except for requests for a specific path in the URL? More details of this are in this topic in the FAQ Peter linked: Multi-Perspective Validation & Geoblocking FAQ
If your firewall allows requests for multiple domain names you could further restrict these inbound ACME Challenge URL just for the domain for the NAS