I've been put behind CGNAT last year, so I'm running Wireguard tunnel to a VPS. Can I simply add new client - a second Linux machine sitting at my network and forward certain ports to it? Do all the clients use the same key then?
In short yes
They all have their own key pair.
Private and public
Each client should know the "servers" public key.
And the "server" should know the client's public key(s)