not familiar with wireguard per se, but afaik it's using udp-packets which get translated/mapped just fine by any NAT implementation. nothing in need of punching imho.

if your access concentrator (server) is behind a nat, you'll need a port-forwarding from the outside but that's rare.