As for the media, a bind mount is the way to go, and I’d also recommend doing it as a read-only mount: Jellyfin doesn’t need the ability to modify that data, and in the event of a security oopsie (or a misconfigured user, or a 6 year old that gets 5 minutes alone with your mouse or…), it keeps someone from trashing your entire media library, assuming that’s something you wouldn’t want to have to spend the time gathering again.

My way to solve this:
My main user is a regular user with no deletion permissions in jellyfin. Anything that requires editing necessitates logging out and in with the admin account.
My docker container is mapped to a non-root user. Not perfectly save but sufficient (hopefully).
But my jellyfin container has R/W because I store nfo/metadata files alongside the media file.