Of course this depends on your environment and needs, but I would not want to expose the zarafa-server to the internet if it can be avoided. If you need to connect i. e. Outlook to this IP, you might rather want to use a reverse proxy, maybe even consider mod_security. Maybe using VPN is possible, so you can completely stay on your private addresses. Just my 2 c :-).