Does it need to be publicly available to properly measure/track the user traffic or it can/should be available internally and all traffic should be proxied from the main app?
You can install Matomo on premise and track internal traffic, say, in an intranet. The tracking code of the intranet site should be able to fire impressions to your internal matomo instance.
This is not I was asking for. I’d like to know if it is possible to take Matomo completely out from the Internet but still collecting data/tracking users in the application exposed to public Internet.
Okay, that should be possible. I saw such instances. But I am not competent at proxy configuration to say, how to do this.