Portainer Server bind address and missing public access constraint

Portainer Server deployment involves a binding decision for the web UI and the reachability requirements of Edge Agents. The default container mapping for port 9000 listens on all host interfaces, which makes the UI reachable from any network path that can reach the host unless additional network controls are applied. Authentication is established during first-run setup with an operator-chosen admin password, and password complexity or mandatory MFA is not enforced by default.

Edge Agents use an outbound TLS connection model to the Portainer Server, so the server must be reachable from remote sites while the management UI should remain limited to trusted networks. Role-based access control governs endpoint and stack permissions, but the administrator role is broad and there is no built-in constraint preventing an admin from exposing the Portainer UI itself via public endpoints.

What bind address configuration preserves Edge Agent connectivity while limiting UI exposure to trusted networks? Is there a built-in permission boundary that prevents the administrator role from publishing the UI to public interfaces? How does first-run authentication interact with network-level exposure before a login is presented?