I know that nginx is much safer than Apache for hidden services, but is there any additional configuration that needs/should/is recommended to be done to run a hidden service safely?
No, not really. In all cases - regardless of the actual web server - you need to use a FULL ISOLATION based on VM/LXC to run a webserver, so there will be NO technically possible way to determine an external IP address or it's traces. You don't use any NAT/IP-MASQUERADE, just a port-to-port tunneling. I do recommend to use a LXC+static-binaries, it will make a footprint almost-nothing and will minimize an overhead.
Review an nginx hardening guide. There are several of them online. The nginx mailing list is probably a great place to start for advice on hardening if you have specific questions about hardening best practices.
When it comes to actual web apps running as onion services, you can use OnionScan to do a basic pen test of your app to see if your IP is leaking any other common problems that onion services have.