I don't think you need to allow the site to be published externally. According to this article: configure-inbound-connectivity. You could use the External URL for your site. External URL :The endpoint URL of the reverse proxy device that faces the Internet.
There are three site collection strategies:
• Host-named site collection
• Path-based site collection (with AAM)
• Path-based site collection (without AAM)
Assuming that you are configuring a site collection strategy by using a path-based web application with AAM. The default zone the web application is http://sp2016, you could extend the web application to Internet zone and use the External URL as the public url for this zone.