Yeah you got it. Set the listening interface to eth0 or whatever the wan interface is. Might need to get full ntpd instead of the busy box version. The Interface option here: https://www.ntp.org/documentation/4.2.8-series/miscopt/
I’m actually setting up a router with a rpi4 right now, only using Fedora IoT instead of OpenWrt. It’s a bit more assembly required lol
I need to have a play with it, but the problem is i deliberately have a 'kill switch' style setup to stop any requests accidentally going not over wireguard (for reasons) so I assume I'll need to do some other firewall type thing. Maybe something something tagging.