This is my plan (in action) for an offline GPS nixie tube clock. I'm not sure about what is the right choice for options. Many are nice-to-have features for people like me, who would be the most likely to want a clock like this (snmp to host drift, jitter, and temperature mrtg logs), but come at the mild cost of security.

Will those who receive this bother to connect it to networks? Should I even enable network/GUI for those who want to tinker easily? How should the password be handled?

I'm considering two extremes:

1. A raspbian lite headless system with all unnecessary peripherals disabled and no network features.

2. A full installation, GUI and all with HDMI and network enabled so it's easy for people to play with it if they want.

I'm leaning towards 2 because I think it would be nice to have a clock that auto updates leap seconds and the tzdata db. If I go for 1, that opens up the possibility of using a raspi zero (non-W) for a real BOM and power savings.

As for the password: I'm thinking of having something short and simple other than "raspberry" that the user can/should change. This seems like standard practice with many enterprise systems.