Thanks for your answers.
For reference, here are the options I added to disable the services:
systemd.services.nginx.wantedBy = lib.mkForce [];
systemd.services.nginx-config-reload.wantedBy = lib.mkForce [];
systemd.services.libvirtd.wantedBy = lib.mkForce [];
systemd.services.libvirt-guests.wantedBy = lib.mkForce [];
systemd.services.docker.wantedBy = lib.mkForce [];
systemd.services.lxd.wantedBy = lib.mkForce [];
libvirtd, docker and lxd can be activated by their sockets, so a docker ps for instance launches the daemon.