How to remove private keys from wallet.dat and create "receive only" wallet? I want to create a wallet for monitoring incoming transactions. So it should be receive only wallet that will be place on hosting, that is potentially not secure. If I understand it well, this won't allow attacker to stole funds if server is compromised. How I can create such a wallet with only public keys? And can I inject private keys later to spend from that wallet from a secure machine?
You're right, storing your private keys on a server is a bad idea - it means you're liable to lose all of your funds in the case of a hack. 

But as you aren't storing them, do you need to install the bitcoin daemon on your server? You could use an API from one of the online blockchains to monitor transactions from your server, and maintain your encrypted wallet.dat on your own computer.