Controls in a nested case-control study are typically selected through incidence density sampling or risk set sampling. Each time a case is identified, one or more controls are selected from those at risk at the time the case occurred. This method ensures that controls are matched to cases on time, reducing the likelihood of confounding variables influencing the results.