MariaDB replication from master to slave
A1. Use Private IPs where practical -- they are somewhat more secure.  This assumes, however, that both Master and Slave are on the same Private network or is 'tunneled' through.

A2. Create a separate "user" for the replication stream.  GRANT only REPLICATION SLAVE to that user.

Use root (or other SUPER) only for admin purposes.  Create specific user(s) for application code.  Grant them more limited access, perhaps GRANT ALL PRIVILEGES ON app_db.*