i understand, according to @alento
Well, this is open to opinion … if your goal is to have no web access to the vm which the email is on, you can certainly turn off access via the firewall and simply deny ports 80/443. As I mentioned earlier, you can run your own install of roundcube, or rainloop, or some other webmail client elsewhere if you wish. That is not a problem.
i should be fine just doing that. plus mailcow use docker which not suitable for me. and Modoboa very slow with updates. so my choice for now is miab .
but off-course if i get to install.