I did option 1 for a number of years but now I’m doing option 3 off a proxmox container and some cloud scripted backup. So far so good.

We just started doing option 3 at work and just keep it behind the firewall. It is going well so far.