How can I follow the validation and verification recommendations of the NaCl (sodium) secretbox library?
This is advice to you, the application protocol designer, on how to use the cryptography.  The word ‘separately’ applies to the packets, not to encrypt and authenticate: use crypto_secretbox_xsalsa20poly1305 for one ≤4096-byte packet at a time.

You should split longer messages into ≤4096-byte packets with sequence numbers.  This way:


The most memory an adversary can force the receiver to waste at a time by sending forgeries is 4096 bytes.
The least bandwidth that the sender needs in order to make progress during a denial of service attack is 4096 bytes.