Does the Unifi mobile app work with the setup you described? If you are outside the network? Do you use a vpn client to connect your phone back inside the network?

Yes, it should. Assuming you're running your unifi controller on a public ipv4 /32 somewhere on the internet (at some commodity VM host), it's entirely up to you how you want to lock down access to it. Some people do leave the TLS1.2 web browser admin control panel login exposed, but on a non standard port, other people set up iptables ACLs to only allow traffic from a certain IP range, other people set it up so that you can only reach the admin control panel login page over openvpn. Entirely up to you and depends on your level of experience with linux sysadmin/firewalling tasks.

However I am more in favor of having the unifi controller on the same premises as the APs, or at least in the same metro area network as the APs, in your own private network. Just throwing the L3 management option out there for people who truly want 'cloud' hosted everything.

>more in favor of having the unifi controller on the same premises as the APs

But when your premise is MANY sites across the country, and you are using a single controller, only ONE site gets the controller on prem, OR you have many controllers running.

>Big difference between like $700-900/year and $120/year.

At the end of the day, it comes down to what my time is worth doing other things (not how much im paid, but the opportunity cost of me managing management interface infrastructure, stability, and resources. Unifi cloud, for lack of a better phrase, just works.)

> But when your premise is MANY sites across the country, and you are using a single controller, only ONE site gets the controller on prem, OR you have many controllers running.

yes, totally agree, in that sort of scenario with many premises you would set up your own internal L3 management of the APs, in your own management VRF, in RFC1918 IP space.