Running standalone with the very minimum can be a good way to keep the hot wallet risk at the minimum, but raspiblitz itself is running quite light by default as well with the addition of lightning. It also really depends on if you have a spare Rpi and SDcard lying around. Hardware isolation is the most secure container.