How to safely backup user profiles to a NAS?

I want to take daily backups of user profiles - at least AppData, Documents, Descktop - to a NAS drive with some degree of security from malware. There are problems with everything I've tried (or just looked at) so far.

1. Macrium Reflect files and folders backups work, but MR sometimes leaves an open SMB connection under my userid to the NAS. Anything running under my userid can access the target share on the NAS without providing credentials. (This happens if a backup is manually invoked or if the backup definition is changed.)
2. Acronis True image using FTP would be a good solution, but the Acronis FTP client is incredibly buggy. Backup management is unreliable.
3. WinSCP would allow secure backups using SFTP, SCP, or WebDAV, but it chokes on the symbolic links (or perhaps junctions) that are in AppDATA.

What other options are there that I've missed?

BTW, the logic behind this is that I can get away with weekly image backups if I back up changeable stuff daily. 2 desktops have local external drives I can back up to, but 2 laptops do not so I back them up to a NAS. And I back up that NAS to another NAS in another location with no direct access (at least no SMB access) from Windows. That isolated NAS also gets weekly FTP backups of the backup files on the desktop external hard drives. That remote NAS has backups 1-2 weeks old, but I really want to daily backups of AppData and Documents.

I don't think it matters, but I'm running Win 10 1909.

Look into Beyond Compare -

Scooter Software: Home of Beyond Compare

We've used it for years to back up daily volatile data, and any critical data that has changed since the last disk image.

Looks good at first glance, but the things I've read about it mostly mention just the comparison features (which I guess is its primary purpose).

How does it handle symbolic links (and/or junctions - I'm pretty shaky on the difference)? For instance, \Users\<username>\Local\Application Data causes WinSCP to choke. Since I'm already in AppData I certainly wouldn't want a backup to follow the link, but I wouldn't want it to die, either.

Can it be invoked in a batch script?

It works well in all the circumstances we use it in.

Since we identify a subset of our data that is volatile and critical, there is not a lot of choices to make.

Several of our sources are located in AppData (Firefox, Thunderbird, Edge, Roboform).

Doesn't make sense for us to back up everything in AppData on a daily basis.

We can see what's changed in the comparison, and it will only sync those.

We don't script it.

There is a free trial so it costs nothing to experiment.