You don't need to restart for the group to be created, that happens when the package is installed. Restarting the services after the group has been added should be enough for users updating the package. You should probably add a post-upgrade note telling people to restart the services after every update.

Create the nordvpn.sysusers file with the information:

g nordvpn - -

Install via PKGBUILD:

install -Dm 644 nordvpn.sysusers "${pkgdir}/usr/lib/sysusers.d/nordvpn.conf"

Finally instruct the user to add themselves to the nordvpn group:

gpasswd -a USERNAME nordvpn