I was able to find jacobalberty/unifi image which uses certificates directly. Upon researching it, it seems there is a script that import existing letsencrypt certificates to UniFi.
This worked for me. I made copy and narrowed it down to my needs (gist). By now, I had already configured nginx reverse proxy, but I really wanted to have it working natively too.