Firewall, Auth on all services, diligent monitoring, network segmentation (vlans are fine), and don’t leave any open communications ports, and you’ll be fine.
Further steps would be intrusion detecting/banning like crowdsec for whatever apps leave world accessible. Maybe think about running a BSD host and using jails.