Mattermost is trivial to self-host so that's probably not a bad option if you're looking for something closer to slack (I think?).
This way all the private stuff can stay inside the network and behind VPN if needed. Security 101 really.
the slack servers probably get a lot more security attention than your private XMPP or IRC server that probably sees a few minutes a year of attention from some engineer to run "apt-get dist-upgrade" or something.
Also, Slack is a much bigger and juicier target for attack.
Ultimately it's a tradeoff. You may need to pay more attention to security in-house, but in exchange you're no longer tying the critical aspects of your business to some random SV web startup that is here today, but may get acquihired tomorrow and kill the product overnight.
Even when running IRC in the browser with IRCCloud it's snappy.