Apart from air-gapping the storage, the simplest approach is to reverse the access policy. This is straightforward to setup on Synology NAS and QNAP devices alike.
The ransomware runs on the PC and has access to its storage. The same access is granted to the backup unit. The PC does not write its files to the backup unit; rather, it is the backup unit that reads the files from the PC through a backup agent (or, at worst, a read-only access to the drive through any network file system available). The PC has a read-only access to the Time Vault storage, and no more.
This means that if a ransomware encrypts my
~/VeryImportantDocument.odt, this will be "seen" by the backup system as "Leonardo has modified
~/VeryImportantDocument.odt", and the next copy that will be taken will be useless to me (being ransomware-encrypted). But I will still be able to restore the version immediately previous to that one. The ransomware will be unable to delete or encrypt those data.
Also, when running the backup, the backup unit makes a plan - it has to, to ensure there is sufficient storage for a consistent snapshot. Since I have confirmed that I never change more than 1% (and that's a gross exaggeration) of my files every day, I have set up things so that as soon as the daily changed files counter goes beyond this limit, a warning is issued.