I managed to get this working with NordVPN. I was running in linux with the official NordVPN client. The key thing was this command:
nordvpn whitelist add port 9993
nordvpn whitelist add subnet ZT_SUBNET
The ZT_SUBNET should be the zerotier subnet you’ve configured (e.g. 1.0.0.0/24). You may also want to whitelist any other resources on the local network.
Doing that, I was able to reach both ZT resources as well as reach out through the privacy VPN provider. I have the local network of my home network also whitelisted. I don’t remember if that was necessary for ZT to start up or if that was something I setup to access local resources at home.