Best way to integrate two sites with different security levels
Naomi, CiviProxy at the moment deals with mailings and stuff, and whitelists API calls. So if you would want to create a donation page on your public website, you would probably use the API to send data to CiviCRM. 

When using CiviProxy your public website would send the API request to CiviProxy. CiviProxy would then check if the API request is allowed, and if so pass it on to CiviCRM.

If you want to build forms that communicate with CiviCRM on a separate server you might also want to take a look at CMRF.

There is a blogpost on a recent sprint about this topic you might want to read.