Ideally you'd at the router level block incoming connections to the Mac except for the specific ip address you expect to come in on.
If you want to be able to access it from anywhere, the IP address based blocking isn't going to work for you, so at that point you should come in by VPN. I use OpenVPN for this.
Otherwise, it's just the basics, including strong passwords and keeping your system patched and up to date.
Regarding whether exposing SSH is more or less secure than exposing VNC, assuming strong passwords and an up to date system, the difference is (in theory) the ability to intercept. I'm not sure what password protection implementation this particular VNC server uses. SSH is secure in this regard. So my gut feeling is SSH-only would be safer.
I think your best bet to remotely access is SSH or VPN only.