Before this discussion can and should go any further, we should address the real issue at the heart of everything:
why are any requests from the clients going to /var/www and not /var/www/nextcloud? The SINGLE change I made was to simply lock down the /var/www directory – this would NOT stop any requests going to that directory, it would simply block them from getting through. My change to the base Apache config merely exposes the issue, it didn’t cause it.
So, let’s answer that question first, and then we can move on. Likely, in answering that question, we can fix the issue, too.