What about only Setting up a Private Handler connected to the Public Community Network? (That Labs story is almost 3 years old, so might be outdated. And one won’t have TTN Console to administer applications and devices then, I think, so the command line ttnctl is needed. Maybe one gets TTN Console when using the handler from the V3 stack, if at all possible with the community network.)
I am not 100% sure that a private handler mitigates LoRaWAN security: Can the Network Server generate the AppSKey? which describes a limitation in LoRaWAN 1.0.x, as currently used by the public network.