That’s what I do. Sensible firewall rules with ufw, turn off services I don’t use, follow the docs for the services I do. For a handful of servers the maintenance overhead is fine.