not familiar with wireguard per se, but afaik it's using udp-packets which get translated/mapped just fine by any NAT implementation. nothing in need of punching imho.
if your access concentrator (server) is behind a nat, you'll need a port-forwarding from the outside but that's rare.
Tailscale builds a mesh, where the participants can communicated directly, so it's common for all nodes to be behind a FW that does NAT. There is a very interesting blog post from tailscale about all the trickery they pull to reliably deal with NAT: https://tailscale.com/blog/how-nat-traversal-works/
if your access concentrator (server) is behind a nat, you'll need a port-forwarding from the outside but that's rare.