@jtt7

If you're going to be running PHP, then you'll need a web server to handle the requests unless you plan on using PHP's Built-In web server (not advised as it's not meant for production).

VestaCP will setup NGINX, PHP-FPM, and MySQL/MariaDB for you during it's setup, so if you go with it, there's very little configuration needed unless you need very specific configuration for your server blocks (which would require you to edit the server blocks by hand).

For VestaCP, I'd advise running Ubuntu 16.04 64bit.

Alternatively, you can manually setup everything by hand by either using the package manager or by compiling from source. This gives you more control, though it does take a little more time to do (even more so if you compile from source).

When it comes to security, that's something you'd have to figure out in terms of what you need. Most CP's will install a Firewall but that's about it. You'd need to setup SSH Keys, a Sudo user, etc on your own as most automated solutions won't factor in much security as it's impossible to know what each person will use the software for. Security is really purpose and application dependent and you'd need to figure out what you need the most and lock down the rest.