Mine is publicly exposed using the standard nextcloud:stable-apache docker container, with nginx (past) / traefik (present) handling TLS termination, but not otherwise adding additional security measures.
It's been this way for several years and I'm yet to have issues, but it's certainly not bulletproof since a critical vuln in Nextcloud could pwn it. That just hasn't happened.
An SSD will improve responsiveness, but it's not strictly necessary. Linux is less HDD/SSD sensitive than Windows, but the difference is still there.
However 2GB is really pushing your limits. You'll get to desktop, but you'll struggle to get a web browser happy with that. If you want to make a headless server out of it, however, that's a perfectly fine amount.