Assigning a public IP to a L3 switch

Hey,

Is it good practice to assign a public IP to a L3 switch to be managed remotely?

And would turning off web GUI via cli help to limit some security risks by opening a switch to the public?

Or would doing a site-to-site VPN be a better option to manage that switch.

Just want to hear from some gurus on here on the risks of opening my switch up to a pub IP.

Thanks!