In this case what I would recommend is to put the entire server off the internet, on a separate network segment where it can only talk to a proxy for VNC & web

In this case what I would recommend is to put the entire server off the internet, on a separate network segment where it can only talk to a proxy for VNC & web sockets or whatever is needed to make the functionality work. That way even if the machine does get rooted, it's very unlikely that any damage can be done (it would have to then try and compromise the proxy - all over VNC because you can't even get a reverse shell yet - just to be able to gain unrestricted outbound network access).