Backup using rsync – what options are used

Although Incremental and Differential backups have specific meaning, I don't think in your case that you need to focus on whether rsync does one or the other. It can be configured to do either, though as I understand, not "easily" through the ReadyNAS UI in version 6.

If your ReadyNAS units are running OS 6, then the simplest solution for your various users may be to enable snapshotting on the volume or volumes in question and make sure that snapshots are NOT browseable by the users.  That means the snapshots won't be exposed via SMB and CryptoLocker or other malware won't find them. If you are running large databases or have large files with frequent changes, you might look into how well this performs.  I also cannot recommend this with the current 6.4.0 release as there are a lot of performance issues related to purging snapshots.  

It's a good idea to practice your restore procedures too so that If you do get struck with malware of ANY kind you can be sure that your backups remain "read-only" and cannot be edited or infiltrated by the malware as you try to do your restore.

Older versions of the ReadyNAS software (before version 6) do not use the btrfs filesystem and so do not have the unlimited snapshot capability. If you are using an older version of the ReadyNAS software then you can definitely do a volume-to-volume rsync with options that suit your needs.  The key to undestanding the most powerful feature here is to read up on how hard links work in Linux and how to take advantage of hard links with rsync using the --link-dest option.  In a nutshell, --link-dest can give you either incremental or differential backups (depending on how you set it up) that are a breeze to restore because the UNCHANGED files for each incremental backup are hardlinked.

To explain in detail.  A properly designed rsync command or script can be used to create a time-stamped backup folders in a format that looks like:

..
Volume1_Backup_20151115-0900/
Volume1_Backup_20151115-1300/
Volume1_Backup_20151115-1700/

Inside each folder would be a COMPLETE copy of all the files on the original Volume1 at the date and time indicated.  Any files that are the SAME would be hardlinked to each other to save space, any files that are different in each folder would not be linked.  Of course,  if THESE folders were exposed to malware, they could get corrupted, but the idea is that these folders are locked down perhaps with only read permission enabled and definitely not accessible via SMB.  So, your concern with a malware infection on the original Volume1 would mean that rsync would see the corrupted file as changed and when copying it to the backup, it would NOT overwrite the originals.

I have two final thoughts:

1)  We've had very good luck with CrashPlan.  It's not officially supported on ReadyNAS, but perhaps your Windows Servers or Workstations could run the application and move your backups safely to offsite.  It's something like $10/month per computer, but even for 50 servers I think it's totally a bargain to get rock-solid offsite backups for an entire nationwide organization for only $500/month.  I can't say I advocate for CrashPLan over BackBlaze or Carbonite, they all seem pretty decent.  CrashPlan has a fairly sophisticated central control application for their Pro line of software, which could mean a kind of easy "central monitoring" of how the backups are working.

2) Whatever backup strategy you do use, please make sure whoever is performing the backups uses a retention policy that includes keeping older versions of the backup for a long time. On our old backup server, I kept weekly backups for half a year, monthly versions going back as far as 15 months, and then half-year versions going back as far as 3 or 4 years.  If you do get a malware infection, you may have to go a long way back in time to find a version that wasn't corrupted.

best of luck