To be honest, I'm not sure. I think I've seen people set it up in a directory from the domain (e.g. domain.com/service) but I think it makes the nginx configuration a little more complicated, and possibly some extra settings in the nextcloud config.php? I've always used service.domain.com, so in your case nextcloud.domain.com and emby.domain.com, and separate certificates for each service. It works well for me, and I have several other services on different domains working through the same reverse proxy.