A public node is typically referred to as a node that helps other nodes with things like the IBD.
Your node won't work without being able to get block data from peers, but you don't have to allow inbound connections from other nodes.
I'm not exactly sure how Start 9 sets everything up, but I know for instance my node is technically considered a public node because I allow inbound connections. And if I disabled that "allowing inbound connections", I could still get block data from the network which would make things more private and wouldn't allow people to directly connect to my node.
