Generally when evaluating security, you need to balance likelihood and severity of threats against the resources available to counter them. A human rights organization that was a client of mine had information on activists in their CiviCRM instance who could be imprisoned or killed by their governments, with sophisticated, well-resourced governments interested in getting that contact information: high threat, high consequences. In that kind of a context it might make sense to avoid exposing your CiviCRM system to the public web. Another client of ours, Nader for President 2008, also used an instance of CiviCRM hosted on a hardened server that was not exposed on the web, using custom software to migrate relevant contact information into CiviCRM.
For the last several years, the supported and generally available releases of CiviCRM require a CMS to be installed on the same server to manage user accounts and permissions.
In your case, I would recommend putting CiviCRM and Joomla! on the same VPS/server, and keeping your Joomla! software up to date with all security upgrades/patches. Follow the Joomla security best practices listed at https://docs.joomla.org/Security_Checklist. A more in-depth practical guide developed for Drupal but containing many generic sections can be found at http://openconcept.ca/drupal-security-best-practices-practical-guide.
