Do you serve the instance on the public internet or on a VPN?

I've been thinking about self-hosting myself, but for my purposes (open source), I'm worries about scrapers and other sources of DOS-like traffic.

VPN, accessible only from inside the corporate network