chmod -R a+rX /path/to/pictures will grant "world-readable" to things so immich would be able to find them. You'd then want to set something like umask 002 for Nextcloud to create files by default with world readable permission. If it's running in a container I'm not sure how that is done as I've not done it before. You then hope Nextcloud doesn't set it own file permissions, which it may out of a duty to be more secure.
If you don't want files to be world-readable you could create a group that nextcloud and immich share then set group ownership. You may need to set a "sticky" bit to maintain the group ownership and then hope the individual applications don't override it, which they probably will.
If you can get both apps to use the same user or group that would probably be best. With the containerized versions of these you might be able to pass in a UID/GID for them to use?