For security point of view, recommend to place MXP Endpoint behind firewall and use VCS Expressway if require public connectivity.
MXP Endpoint has reasonable security level but still open for range of ports for system management and also for conference call.
Also if you are looking for security on call, recommend for SIP call with TLS as call transport protocol (and enable encryption for call) for securing call management signal and also audio/video payload between far end.