I think you should use Composer + Public Path = Yes. This is the security-preferred arrangement in Flarum's documentation. In this case visitors can access index.php and assets, while sensitive files such as config.php, composer.json, and vendor folder remain outside the web-accessible directory.
Public Path = No is useful when your hosting environment doesn't let you choose the webroot, such as some shared hosting environments where you're stuck with public_html folder.
