How many VIRTUAL_PATHs can I specify for a container? Based on this, it appears as though the VIRTUAL_PATH variable overwrites the default value of / instead of adding to it, or am I reading it wrong?

For my one, single container, I want the / path to be unrestricted while the /admin path is restricted to LAN traffic only. So my one, single container should have two location blocks -- one for / and one for /admin that blocks non-LAN traffic.

You don't need VIRTUAL_PATHs indeed. Sorry the Per-VIRTUAL_HOST settings is what you need.

For example, if you have a virtual host named app.example.com, you could provide a custom configuration for that host as follows:

create your virtual host config file:

# content of the app.example.com file
location /admin {
    # Restrict access to only some IP (LAN IP & VPN)
    allow 172.16.0.0/12;
    deny all;
}

mount it to /etc/nginx/vhost.d/app.example.com
Check the Docker Compose File example in the linked documentation how to mount this file in your container.
This will automatically include your config with /admin location as an additional location block.

I am interested in the same question. Did you come up with a good solution @beechfuzz ?
I am trying to make it as generic as possible so that I can use it in many places.
Thank you!