I think I'm okay based on that description, as the network shares require usernames and passwords and are only available on a specific network internally (I have 2 wireless networks, a guest network and a personal network -- only the personal network as access to the NAS).
When I turn off the VPN and try to connect to the NAS, it fails to do so because the IP range isn't valid (when on the guest network or an outside network).
When I am on the personal network, accessing the NAS is available as long as you have a valid username and password (both on the NAS and setup within SAMBA).
As an aside, I must not have done my test right the other day, as I just disabled IP forwarding and I can connect my map network drive just fine still...
So I guess I am confused on when IP forwarding would be needed. Do you only need it if you have separate subnets that are only accessible from behind the VPN server?